SZB-471e54d21b
Miaomiaowu IDOR lets users read others' proxy configurations (EUVD-2026-113935)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- iluobei
- Product
- Miaomiaowu
- First seen
Summary
The EU Vulnerability Database (EUVD) lists an insecure direct object reference vulnerability in Miaomiaowu before 0.9.3, scored 5.3/10 (CVSS v3.1). According to the entry, authenticated users can read other users' configurations through /api/user/proxy-provider-configs by iterating sequential IDs.
If you use iluobei
Upgrade Miaomiaowu to 0.9.3 or later
Rotate any subscription credentials stored in proxy provider configurations
Review access logs for enumeration of the affected endpoint
What the sources say 1
· Mastodon: “Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations.” Source