Webreaper vulnerabilities
We track 1 vulnerability in Webreaper products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
1vulnerabilities
1critical
0high
0exploited
9.8average CVSS score
Latest Webreaper vulnerabilities
- 9.8 Critical severity
Damselfly: Missing Authentication for Critical Functionality
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin role