Authorization Bypass in reNgine Affects User Access to Configuration Files

CVE-2026-92570

What is CVE-2026-92570?

reNgine versions up to 2.2.0 are susceptible to an authorization bypass vulnerability in the GetFileContents API endpoint. This flaw allows any authenticated user, including those with low-privilege Auditor roles, to access sensitive configuration files containing third-party API keys for services such as SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter. The lack of role-based permission checks enables unauthorized access to these files, potentially compromising the security of connected services and exposing sensitive data.

References