Key points
- The flaw exists in SuggestArr before version 3.0.0.
- It is rated Critical with a CVSS score of 9.1 by NVD.
- Attackers can bypass login checks using spoofed X-Forwarded-For headers.
SuggestArr releases earlier than version 3.0.0 contain a critical vulnerability that allows remote attackers to bypass authentication entirely. The National Vulnerability Database rates the issue at 9.1, classifying it as Critical. The source material does not confirm the availability of a fix.
In plain English
The software incorrectly trusts the IP address provided in incoming web requests. Specifically, the configuration in api_service/app.py uses ProxyFix with x_for set to 1. This causes the middleware to accept the client-controlled X-Forwarded-For header as the true source address for request.remote_addr.
The background
According to the NVD record for CVE-2026-113703, the enforce_authentication function in api_service/auth/middleware.py relies on this trusted address. If an attacker sets the X-Forwarded-For header to a trusted value like 127.0.0.1, the system believes the request originates from localhost. This triggers _load_bypass_user_context to grant an admin session.
What changes now
Attackers gain full administrative access to sensitive endpoints such as /api/users and /api/jobs without providing any credentials. This weakness is categorized under CWE-290. The vulnerability affects the local_bypass authentication mode specifically.
Who needs to act first
Teams should prioritize systems exposed directly to the internet. Check whether your deployment uses the local_bypass authentication mode. If so, isolate those instances immediately. Roll out any available configuration hardening that restricts trusted proxy headers. Test changes in a staging environment before applying them to production. Back up current configurations to allow quick rollback if issues arise. Monitor logs for unusual X-Forwarded-For values.
What to do and how to stay safe: SuggestArr
- Identify all instances running SuggestArr before version 3.0.0.
- Restrict access to SuggestArr endpoints using network-level firewalls.
- Monitor server logs for requests containing spoofed X-Forwarded-For headers.
- Wait for the vendor to release an official update before modifying core code.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which SuggestArr versions are vulnerable?
All versions before 3.0.0 are affected by CVE-2026-113703.
What is the severity rating?
The NVD rates the vulnerability as Critical with a CVSS score of 9.1.
Can attackers access admin functions?
Yes, attackers can gain unauthenticated admin access to endpoints like /api/users.
