Cleanuparr
Approved changes feed: RSS · Atom
cpe:2.3:a:cleanuparr:cleanuparr:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cleanuparr (fbfe7547-c66c-5442-8458-94e4320c1374) |
|---|---|
| Product | Cleanuparr (9db7e946-6e6b-59f6-bad8-efd1e8d7f8e6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44184 |
vulnerable | 2026-06-08 08:03:18.107986 |
Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads
HIGH (8)
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's global CORS policy reflects every request Origin and combines it with AllowCredentials(). When DisableAuthForLocalAddresses is enabled, the API also authenticates requests purely by source IP via TrustedNetworkAuthenticationHandler. The combination lets any website that an admin (or any user on a trusted IP) visits read authenticated API responses cross-origin — including the admin's permanent API key. This vulnerability is fixed in 2.9.10.
Published: 2026-05-12T17:33:50.855Z
Updated: 2026-05-12T18:38:28.447Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44183 |
vulnerable | 2026-06-08 08:03:18.107658 |
Cleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabled
CRITICAL (9.8)
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, TrustedNetworkAuthenticationHandler.ResolveClientIp parses the leftmost entry of the X-Forwarded-For header as the client IP. That entry is attacker-controlled — X-Forwarded-For is append-only, so the leftmost value is whatever the original HTTP client claimed. By sending a spoofed local IP in the header, an unauthenticated remote attacker passes the trusted-network check and is logged in as the Cleanuparr administrator. This vulnerability is fixed in 2.9.10.
Published: 2026-05-12T17:32:52.143Z
Updated: 2026-05-13T14:40:12.723Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32702 |
vulnerable | 2026-06-08 07:57:18.052837 |
Cleanuparr has Username Enumeration via Timing Attack
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. From 2.7.0 to 2.8.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. It appears that the hashing function, which is the most time-consuming part of the process by design, occurs as part of the VerifyPassword function. With the short circuits occurring before the hashing function, a timing differential is introduced that exposes validity to the actor. This vulnerability is fixed in 2.8.1.
Published: 2026-03-13T21:09:00.127Z
Updated: 2026-03-16T16:47:53.284Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.