CVE-2026-113703

Summary

The SuggestArr application contains an authentication bypass vulnerability where attackers can spoof their IP address to gain admin access without credentials. This allows full administrative control over user and job management endpoints.

Exploitability

Easy to exploit with a single HTTP request setting X-Forwarded-For header to a trusted IP like 127.0.0.1, requiring no prior authentication or credentials.

Blast radius

High impact as attackers can access sensitive administrative endpoints like /api/users and /api/jobs without any authentication, potentially leading to complete system compromise.

Detection

Monitor for requests with X-Forwarded-For header containing trusted IP addresses like 127.0.0.1 that access administrative endpoints (/api/users, /api/jobs) without proper authentication tokens in the logs.

Prioritized remediation

Upgrade to SuggestArr 3.0.0 or later to fix the authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.