Webreaper Damselfly Authentication Bypass Vulnerability

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out.

Attackers can gain full control by:

• sending PUT /api/users with Admin roles to create administrator accounts
• POST /api/users to reset any user's password