# Unauthenticated admin and setup endpoints

Privileged setup, restore, decrypt or dashboard routes reachable with no auth check in the handler

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; latest 2026-09-11. Updated 2026-10-23._

## How it works
A privileged function — create a user, restore a backup, read or decrypt a stored secret, run a job — sits on a network path that never verifies the caller. The code assumes "only admins reach this route" or "the UI hides it," so the handler acts on the caller's say-so. The broken assumption is that reachability implies authorization. When the route is reachable, the action runs.

## Where it shows up
- Admin API enabled by default in shipped runtimes, with no token check and wildcard CORS on every admin endpoint [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rqx4-3f6q-3x2v.md)
- Setup/restore/import actions (`setup-restore.action`) that skip the re-auth (WebSudo) other admin paths enforce [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md)
- A service API on a fixed port returning stored credentials, plus a separate decrypt method returning plaintext [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-veeam-backup-replication-cve-2023-27532-response.md)
- Handlers that trust the frontend to hide them instead of checking the session server-side [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rqx4-3f6q-3x2v.md)

## How to review
For every privileged route, find the authorization check inside the handler, not in routing or the frontend. The invariant: each request that creates a user, restores data, decrypts a secret, or launches a job must verify an authenticated, authorized principal at the point of action. Confirm setup/restore paths require the same re-auth as other admin actions [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md). Check whether admin planes are on by default and reachable from untrusted networks [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rqx4-3f6q-3x2v.md). For a credential service, enumerate every method the port exposes, not just the patched one: a read endpoint plus a decrypt endpoint is one capability, so both must be gated [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-veeam-backup-replication-cve-2023-27532-response.md).

## Variants seen
- Unauthenticated admin API with wildcard CORS, letting any caller read/write env vars and harvest auth headers [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rqx4-3f6q-3x2v.md)
- Setup-restore endpoint missing re-auth, letting an unauthenticated caller upload a backup and create an admin [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md)
- Unauthenticated service API leaking encrypted credentials, with a companion decrypt call returning plaintext [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-veeam-backup-replication-cve-2023-27532-response.md)

## Why fixes fail
Patching one method leaves siblings open: adding auth to the credential-read call did not cover the separate decrypt endpoint, so a read became plaintext [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-veeam-backup-replication-cve-2023-27532-response.md). Fixing one admin path while `setup-*`/restore actions still skip re-auth leaves the bypass intact [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md).

## Impact and severity
High: admin creation and ransomware deployment [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md), credential disclosure enabling lateral movement and RCE [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-veeam-backup-replication-cve-2023-27532-response.md), and secret theft plus mock-state hijack [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rqx4-3f6q-3x2v.md). Severity rises when the endpoint is internet-reachable, when the resulting identity is privileged, and when leaked secrets feed further access [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rqx4-3f6q-3x2v.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-veeam-backup-replication-cve-2023-27532-response.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-rqx4-3f6q-3x2v.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-veeam-backup-replication-cve-2023-27532-response.md