CVE-2026-42569: Phpvms Laravel Importer Route Group Missing Auth
Laravel `Route::group` registers the legacy `/importer` endpoints without authentication or admin-authorization middleware. The route group only applies the `web` middleware (session + CSRF), which does not verify identity, so a remote unauthenticated attacker can invoke `ImporterController` actions (`@config`, `@dbtest`, `@run`, `@complete`) and trigger the
PHPgreprules fetch cve-2026-42569-phpvms-laravel-importer-route-group-missing-auth --engine opengrepDescription
Laravel `Route::group` registers the legacy `/importer` endpoints without authentication or admin-authorization middleware. The route group only applies the `web` middleware (session + CSRF), which does not verify identity, so a remote unauthenticated attacker can invoke `ImporterController` actions (`@config`, `@dbtest`, `@run`, `@complete`) and trigger the
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.