CVE-2026-61718 | bunkerweb is an Open-source and next-generation Web Applicat… | CVSS 5.4 MEDIUM

Description

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @login_required, including POST /cache/delete, allowed low-privilege read-only reader accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.

Metadata

CVE ID: CVE-2026-61718
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-07-10 18:51 UTC
Published: 2026-07-16 19:15 UTC
Last updated: 2026-07-17 18:06 UTC
Primary CWE: CWE-285
CWE-285: Improper Authorization
Vendor / Product: bunkerity / bunkerweb
Sources: cve.org · NVD

Severity & Metrics

5.4 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
bunkerity	bunkerweb	—	>= 1.6.2, < 1.6.12

Weakness (CWE)

CWE	Source	Description
CWE-285	cna	CWE-285: Improper Authorization
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.4	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References (3)

https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q7rm-935c-v39g https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q7rm-935c-v39g
https://github.com/bunkerity/bunkerweb/commit/685ccbbe7d204132a843a7b7fd802d1bdb3f20a9 https://github.com/bunkerity/bunkerweb/commit/685ccbbe7d204132a843a7b7fd802d1bdb3f20a9
https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.12 https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.12