SuggestArr Authentication Bypass Vulnerability

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode.

The flaw is in enforce_authentication() in api_service/auth/middleware.py, which trusts the client-controlled request.remote_addr value. Because api_service/app.py configures ProxyFix(x_for=1), this value is derived from the spoofable X-Forwarded-For header.

• Affected versions: before 3.0.0
• Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1
• This grants an unauthenticated admin session via _load_bypass_user_context()
• Full administrative access to endpoints like /api/users and /api/jobs is possible without credentials