CVE-2026-92570

Medium CVSS 6.5

Published 2026-09-16 · last changed 2026-09-18

The fix

We hold no Microsoft remediation data for CVE-2026-92570, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter by querying the endpoint without role-based permission checks.

Sources

NVD record for CVE-2026-92570

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N