External risk intelligence

RansomLook Unauthorized Access to Private Group and Ransom Note Data.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-78372

The vulnerability resides in a web application and API interface that is designed to be remotely accessible over the network. Because the service functions as a public-facing web platform for viewing and searching entity data, these endpoints are exposed by design to users, making the attack surface inherently internet-facing.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE concerns a flaw in RansomLook that allows unauthorized remote access to private information, such as group and ransom note details. This could expose sensitive data by bypassing intended security checks within the application's web views and API endpoints.

Unauthorized access to private data is possible.
Protects sensitive group and ransom note information.
Confirm relevance and exposure of private data.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability remotely by accessing specific web views or API endpoints of RansomLook. The attacker can leverage these exposed functionalities, which do not consistently enforce authorization checks for private information, to access sensitive data. This can lead to the disclosure of private group or market names, ransom-note content, and associated metadata.

No authentication required for access.
Exploitable via web views and API endpoints.
Risk of private data disclosure.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could access private group or market names, ransom-note content, and associated metadata. This could occur through web views or API endpoints that do not consistently enforce authorization checks.

Private group and market information at risk.
Unauthorized access via web views and APIs.
Exposure of sensitive content and metadata.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in RansomLook, which allows unauthorized access to private data, likely falls under the responsibility of the application owner or platform team managing the service. The immediate first step is to identify all instances of RansomLook, determine their accessibility and criticality, and then ascertain the accountable owner to plan remediation.

Application owners should lead remediation efforts.
Verify if private data is exposed externally.
Plan for coordinated updates or access controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is RansomLook?

RansomLook is a web-based platform designed for monitoring, searching, and analyzing data related to various cyber extortion entities. It provides interfaces and API endpoints that aggregate information such as ransom notes, group names, and activity metadata, allowing users to track and query information about threat actors.

How does CWE-862 apply to CVE-2026-78372?

CVE-2026-78372 involves a Missing Authorization weakness, categorized as CWE-862. In this specific context, the software fails to verify if a user has the appropriate permission to view sensitive information before responding to a request. Because these checks are missing on key web views and API endpoints, the system erroneously serves data intended to be private to anyone who requests it.

Do I need to be authenticated to trigger this vulnerability?

No. The vulnerability does not require authentication or any specific user interaction. An attacker can access restricted data simply by sending requests to vulnerable web views or API endpoints. It is important to note that internal requests from authorized users function as intended; the flaw specifically allows unauthorized parties to bypass the privacy logic.

Is my RansomLook instance at risk?

According to Halo Surface Signal, this vulnerability is highly relevant because RansomLook is fundamentally a public-facing web platform. Since its API and web interfaces are designed to be accessible over the network to perform their search functions, the vulnerable endpoints are inherently exposed to the internet, making them reachable by remote attackers.

What should I do if I run RansomLook?

First, locate all deployed instances of the software within your environment to assess where private data is stored. Determine the current accessibility of these instances, specifically identifying those exposed to the internet. Coordinate with the platform team or application owners to prioritize applying the software update that introduces the necessary privacy checks and authorization filtering.

References

github.com/RansomLook/RansomLook/commit/dc92d6d5c076bcdbf3476aca…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.