CVE-2026-78372

*** Pendiente de traducción *** RansomLook does not consistently <br /> enforce authorization checks when accessing groups, markets, and ransom <br /> notes marked as private. An unauthenticated or otherwise unauthorized <br /> remote attacker can access information associated with private entities <br /> through several web views and API endpoints.<br /> <br /> <br /> The affected functionality can <br /> disclose private group or market names, ransom-note content, and <br /> metadata associated with private groups. The /compare<br /> functionality can also be queried directly with the name of a private <br /> entity, allowing an unauthorized user to retrieve information such as <br /> post counts, mirror totals, and uptime even when the entity is excluded <br /> from the normal user interface. The patch explicitly adds a privacy <br /> check before returning this information. <br /> <br /> <br /> Ransom-note views, search results, <br /> and API endpoints were similarly missing consistent filtering. The fix <br /> introduces normalized private-group identifiers and alias handling, then<br /> rejects or filters notes associated with private groups before <br /> returning them to unauthorized callers. <br /> <br /> <br /> An attacker can exploit the issue <br /> remotely without authentication or user interaction, resulting in <br /> disclosure of information that was explicitly intended to be restricted <br /> to authorized users.