CVE-2026-102245 | MODSetter SurfSense up to 2.0.3 circleback Endpoint circleback_webhook_route.py missing authentication

September 28, 2026 Yanac

A vulnerability was found in MODSetter SurfSense up to 2.0.3 and classified as critical. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication.

This vulnerability is tracked as CVE-2026-102245. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More