Answer in brief
CVE-2026-113703 records a Critical severity (CVSS 9.1) vulnerability in SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing. The current sources do not mark it as known exploited. The current feed maps giuseppe99barchetta/SuggestArr (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps giuseppe99barchetta/SuggestArr (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| giuseppe99barchetta/SuggestArrgeneric | >=1.0.4 <3.0.0 | 3.0.0 |
Published upstream
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 20, 2026
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.
Quoted source text, attributed separately from HOL analysis.