# CVE-2026-55835: Lookyloo parameter injection in report API endpoint

Source: https://junglewise.ai/threats/cve-2026-55835-lookyloo-is-a-web-interface-that-allows-users-to-capture-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-55835 · Severity: info · Published 2026-10-23

Lookyloo is a web interface for capturing and analyzing website page load chains and domain interactions. An unauthenticated attacker can trigger administrative-level MISP database queries by submitting a report through the /json/report API, potentially causing denial of service on the connected MISP instance and header injection through unvalidated email parameters.

Technologies: [Lookyloo](https://junglewise.ai/threats/technologies/lookyloo). Vendors: [Lookyloo](https://junglewise.ai/threats/vendors/lookyloo).

## Quick answers

**Is CVE-2026-55835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55835 being exploited in the wild.

**How severe is CVE-2026-55835?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Lookyloo before 1.39.4.

**Is there a fix for CVE-2026-55835?** Yes: fixed in 1.39.4. Until then: Restrict access to the /json/<uuid>/report API endpoint to authenticated users or trusted sources if integration with MISP is enabled.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55835 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55835?** Check whether you run Lookyloo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.39.4

Restrict access to the /json/<uuid>/report API endpoint to authenticated users or trusted sources if integration with MISP is enabled.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-23"}]

## Technical details

The /json/<uuid>/report endpoint passes user-supplied email and comment parameters as positional arguments to send_mail(), causing them to bind to the wrong function parameters: email overwrites as_admin (triggering admin lookups) and comment overwrites the email field, which is then used in the Reply-To header without validation. An unauthenticated attacker can provide any non-empty email string to set as_admin=True, enabling admin-scoped MISP queries and potential header injection via newlines in the comment field.

## Affected products

- Lookyloo Lookyloo before 1.39.4

## References

- [https://github.com/Lookyloo/lookyloo/commit/d5b9a401998cd50b88e5d7425f82baac78d8f082](https://github.com/Lookyloo/lookyloo/commit/d5b9a401998cd50b88e5d7425f82baac78d8f082)
- [https://github.com/Lookyloo/lookyloo/pull/1330](https://github.com/Lookyloo/lookyloo/pull/1330)

## Related threats

- [Lookyloo denial of service via zip bomb in capture imports](https://junglewise.ai/threats/cve-2026-66913-lookyloo-denial-of-service-via-zip-bomb-in-capture-imports)
- [Lookyloo stored XSS in capture tree visualization page](https://junglewise.ai/threats/cve-2026-66824-lookyloo-stored-xss-in-capture-tree-visualization-page)
- [Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.](https://junglewise.ai/threats/cve-2025-66460-lookyloo-is-a-web-interface-that-allows-users-to-capture-a)
- [Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.](https://junglewise.ai/threats/cve-2025-66459-lookyloo-is-a-web-interface-that-allows-users-to-capture-a)
- [Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.](https://junglewise.ai/threats/cve-2025-66458-lookyloo-is-a-web-interface-that-allows-users-to-capture-a)