CVE-2026-111644 is a high severity (CVSS 7.3) missing authentication flaw in Misaka Danmu Server through 2.8.9. Several routes under /api/ui skip the login dependency, so anyone who can reach the server can read audit logs and delete data. The record names no fixed version.
What's affected
Misaka Danmu Server 2.8.9 and earlier, per the record and VulnCheck. The affected routes cover audit, diagnostics, data check, scan index and health under the UI API prefix. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The record says an unauthenticated caller can read audit logs including login IPs, read server logs and environment paths, delete episode rows, clear media server mappings and wipe the audit history.
Scoring note: the record's 7.3 is a CVSS 3.1 base score. VulnCheck's advisory also lists 6.9 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Confirm the version you run. Then test from a network position outside your trusted LAN whether the UI API answers without credentials. Use only systems you own.
Check your web server or proxy access logs for requests to the UI API prefix that carry no session cookie or token. Missing audit history may also be a sign that someone cleared it, so compare against your backups.
What to do now
- Inventory instances and versions.
- Do not expose the server directly to the internet. Put it behind a VPN or an authenticating reverse proxy.
- Block the UI API prefix at the proxy for anyone who is not signed in.
- Back up the database so deleted rows and cleared mappings can be restored.
- Rotate anything that appears in the logs, such as tokens or paths that reveal secrets.
- Upgrade once the maintainer publishes a confirmed fix.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Keep a record of what you checked and what you changed. Note the version found, the date, the action taken and who approved it. If the advisory is later updated, for example with a fixed release, you will know which systems need another pass, and an auditor or a colleague can follow your reasoning.
Why it matters
This is CWE-306, missing authentication for a critical function. The framework offers a dependency that enforces login, and these routes simply do not use it. Because the check lives on each route, one forgotten route is enough to leave a door open.
The damage is a mix of disclosure, tampering and loss, which matches the low confidentiality, integrity and availability ratings in the vector. Wiping audit history also removes the evidence you would use to investigate. It is not listed in CISA KEV.
Quick check
Is a login page enough protection?
No. The record says the affected API routes lack the login dependency, so the page does not guard them.
What should I do first?
Take the server off any public network or place an authenticating proxy in front of it.
Sources
Last reviewed: 18 October 2026.
