Back to overview

CVE-2026-55445

CRITICAL
9.3
CVSS 4.0
Description
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.

Metadata

CVE ID
CVE-2026-55445
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-16 21:59 UTC
Published
2026-07-15 21:20 UTC
Last updated
2026-07-15 21:20 UTC
Primary CWE
CWE-287
CWE-287: Improper Authentication
Vendor / Product
whyour / qinglong
Sources
cve.org  ·  NVD

Severity & Metrics

9.3 CRITICAL CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products (1)
VendorProductPlatformVersions
whyour qinglong — < 2.20.1
Weakness (CWE)
CWESourceDescription
CWE-287 cna CWE-287: Improper Authentication
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.3 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References (3)
Back to overview