Dashboard / CVE-2026-121139

CVE-2026-121139

HIGH
MEDIUM Priority: 0.01 BB Relevance: 40/100
Published: 2026-11-05 Modified: 2026-11-06 First seen: 2026-11-05 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: X
AT: Present
VC: High
VI: High
VA: High

Description

The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken's administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller. This issue has been fixed in version 6.5.9.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
Rapid7 Metasploit Framework 0 < 6.5.9
Rapid7 Metasploit Framework 0 < 6.5.9
Rapid7 Metasploit Framework 0 < 6.5.9

References & Advisories (1)

Bug Bounty Relevance

40 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

7.3 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.15%
Raw Score 0.001540
Percentile 4.6%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00154
2026-11-13
0.00154
2026-11-12
0.00154
2026-11-10
0.00154
2026-11-09
0.00154
2026-11-08
0.00154
2026-11-07
0.00154
2026-11-06
0.00154

Intelligence Sources

mitre ref →
nvd ref →

External Links