CVE-2024-31218

Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and earlier are subject to Missing Authentication for Critical Function vulnerability. This vulnerability allows an unauthenticated attacker to send a HTTP request to the database (Pocketbase) admin API to create an admin account. The Pocketbase admin API does not check for authentication/authorization when creating an admin account when no admin accounts have been added. In its default deployment, Webhood does not create a database admin account. Therefore, unless users have manually created an admin account in the database, an admin account will not exist in the deployment and the deployment is vulnerable. Versions starting from 0.9.1 are patched. The patch creates a randomly generated admin account if admin accounts have not already been created i.e. the vulnerability is exploitable in the deployment. As a workaround, users can disable access to URL path starting with `/api/admins` entirely. With this workaround, the vulnerability is not exploitable via network.

• CWE-306

• https://github.com/webhood-io/webhood/commit/735e7fa2814edeec9a2c07778ed51b3c018609f9
• https://github.com/webhood-io/webhood/security/advisories/GHSA-h533-rxhm-73j2
• https://github.com/webhood-io/webhood/commit/735e7fa2814edeec9a2c07778ed51b3c018609f9
• https://github.com/webhood-io/webhood/security/advisories/GHSA-h533-rxhm-73j2

Published

Apr 5, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31212InstantCMS is a free and open source content management syst…7.2
• CVE-2024-31213InstantCMS is a free and open source content management syst…5.4
• CVE-2024-31214Traccar is an open source GPS tracking system. Traccar versi…9.6
• CVE-2024-31215Mobile Security Framework (MobSF) is a security research pla…4.3
• CVE-2024-31216The source-controller is a Kubernetes operator, specialised …5.1
• CVE-2024-31217Strapi is an open-source content management system. Prior to…6.5
• CVE-2024-31219Discourse-reactions is a plugin that allows user to add thei…4.3
• CVE-2024-3122CHANGING Mobile One Time Password does not properly filter p…4.9
• CVE-2024-31220Sunshine is a self-hosted game stream host for Moonlight. St…7.3
• CVE-2024-31221Sunshine is a self-hosted game stream host for Moonlight. St…5.9
• CVE-2024-31223Fides is an open-source privacy engineering platform, and `S…5.3
• CVE-2024-31224GPT Academic provides interactive interfaces for large langu…9.8