Executive brief
wg-portal is a web interface for managing WireGuard VPN server configurations. A flaw in the WebSocket statistics endpoint allows low-privilege users to view traffic statistics and interface details for peers and networks belonging to other users, bypassing authorization checks. This enables unauthorized monitoring of network activity and enumeration of peer identities across the entire system.
Technical details
The vulnerability is an authorization bypass in the WebSocket-based statistics handler (GET /api/v0/ws) within internal/app/api/v0/handlers/endpoint_websocket.go. The handleWebsocket() function subscribes authenticated users to TopicPeerStatsUpdated and TopicInterfaceStatsUpdated events and forwards all TrafficDelta messages without checking whether the user owns or has permission to view the peer or interface. An authenticated low-privilege user can enumerate peer public keys via EntityId and observe BytesReceived/BytesTransmitted statistics for peers belonging to other users. Interface statistics and names—normally admin-only in the REST API—are also exposed. Sensitive data such as tunnel content, AllowedIPs, and user identities remain authorization-gated. The fix was applied in version 2.3.0 with per-user permission checks added to the WebSocket message handler.
Affected products
- h44z wg-portal 2.2.0 until 2.3.0
Timeline
- 2026-09-17: disclosed
- 2026-06-05: patched: Fixed in version 2.3.0 with commit 316f389