{"schema":"threatline.record/2","record":{"id":"CVE-2026-55835","aliases":["GHSA-66gj-hmcp-5cfj"],"summary":"Lookyloo: Potential sub-system DoS due to parameter missmatch in notification","details":"Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's \"report a capture\" email on demand (this is expected). The /json/<uuid>/report API endpoint (CaptureReport) is incorrectly passing the email and comment parameters, overwriting as_admin. When True, as_admin will trigger a search query on a MISP instance (if configured) and add a list of matching URLs in the email sent to the analyst (not the submitter, so there is no risk of leaking information) . It could potentially cause a DoS on the MISP instance. This issue has been patched in version 1.39.4.","categories":["Unclassified"],"product":"lookyloo","vendor":"Lookyloo","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55835","source_modified_at":"2026-10-23T21:05:41.736Z","fetched_at":"2026-10-23T21:10:45.942435Z","product":"lookyloo","vendor":"Lookyloo","versions":[{"version":"< 1.39.4","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00315,"percentile":0.23177,"score_date":"2026-10-23"},"published_at":"2026-10-23T04:14:02.867Z","modified_at":"2026-10-23T21:05:41.736Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-55835","fetched_at":"2026-10-23T21:10:45.942435Z","source_modified_at":"2026-10-23T21:05:41.736Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55835","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-66gj-hmcp-5cfj","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/Lookyloo/lookyloo/pull/1330","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/Lookyloo/lookyloo/commit/d5b9a401998cd50b88e5d7425f82baac78d8f082","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/Lookyloo/lookyloo/releases/tag/v1.39.4","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-23T17:33:07.937098Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T21:05:41.736Z","content_hash":"c1983063b0ab6932a780fcebb2a691bfc11cc7cab514f3f211b8460043801303"}}