Damselfly vulnerabilities

1 known vulnerability in Damselfly from Webreaper. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Damselfly: Missing Authentication for Critical Functionality

  CVE-2026-111626Oct 16, 2026Webreaper

  Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin role