SuggestArr Authentication Bypass Granting Admin Access Rated Critical by NVD

The National Vulnerability Database has assigned a critical severity rating to a new authentication bypass vulnerability in SuggestArr. Identified as CVE-2026-113703, the flaw carries a CVSS score of 9.1 and affects all versions of the application prior to 3.0.0, according to the NVD record.

Attackers can exploit this weakness to gain full administrative access without providing any credentials. The vulnerability exists in the local_bypass authentication mode, where the application trusts client-controlled request data. By manipulating specific HTTP headers, malicious actors can trick the system into granting an unauthenticated admin session via the _load_bypass_user_context() function.

Technical Context

The root cause lies in how the application handles remote address identification. The enforce_authentication() function in api_service/auth/middleware.py relies on the request.remote_addr value. This value is derived from the X-Forwarded-For header, which is spoofable due to the ProxyFix(x_for=1) configuration in api_service/app.py, according to the NVD description.

An attacker can send a request with the X-Forwarded-For header set to a trusted CIDR address, such as 127.0.0.1. The application interprets this as a trusted local source. This allows the bypass of standard authentication checks, granting access to sensitive endpoints like /api/users and /api/jobs. The NVD classifies this weakness under CWE-290, which covers authentication bypass issues.

Affected Systems

The vulnerability impacts SuggestArr software developed by giuseppe99barchetta. The NVD record specifies that versions before 3.0.0 are affected. There is no indication in the source material that a patch or update has been released for these vulnerable versions. Users running older releases remain exposed to this critical risk until a fix is confirmed by the vendor.

This finding follows previous reports on authentication bypasses in industrial control systems, such as the Advantech ADAM-3600 flaw rated critical by the NVD, as Threat Times reported on 2026-10-20. While that incident involved hardware firmware, the SuggestArr issue highlights persistent risks in software authentication logic.

What should you do?

Security professionals should audit their SuggestArr installations immediately to determine if they are running versions prior to 3.0.0. Organizations using this software should review their network logs for unusual access patterns to administrative endpoints. Until a vendor update is available, restricting external access to the application may mitigate exposure.