CVE-2026-92570

reNgine, an open-source automated reconnaissance framework, through version 2.2.0 fails to enforce role-based authorization on its GetFileContents API endpoint (CWE-862). Any authenticated user, including the low-privilege Auditor role, can query the endpoint over the network without a permission check and read the bundled configuration files for its recon tools. Those files contain the instance's third-party API keys for services such as SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter, so an attacker gains full disclosure of stored credentials that can be abused or resold. Anyone running a self-hosted reNgine instance — typically bug-bounty hunters and security teams on internet-reachable VPS deployments — is affected if untrusted users hold Auditor accounts. No public proof-of-concept is known and the flaw is not in CISA's KEV, so exploitation has not been confirmed.

What to do: Upgrade reNgine to a patched release as soon as one is published (no fixed version is specified in current disclosures) and restrict the Auditor role to fully trusted users. As interim mitigation, block or restrict access to the GetFileContents endpoint at the reverse proxy/WAF layer and review instance logs for API calls made by Auditor-role accounts. If low-privilege users could have reached the endpoint, rotate the stored Shodan, Censys, VirusTotal, SecurityTrails, BinaryEdge and Hunter API keys.