# CVE-2026-61718: Bunkerity BunkerWeb authorization bypass in cache management routes

Source: https://junglewise.ai/threats/cve-2026-61718-bunkerity-bunkerweb-authorization-bypass-in-cache-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-61718 · Severity: medium · CVSS 5.4 · Published 2026-07-16

BunkerWeb, an open-source web application firewall (WAF), contains a security flaw in its management interface. The vulnerability allows users with restricted, read-only access to bypass security controls and delete critical system cache files. An attacker with low-level credentials could use this to remove security rules, IP blacklists, and configuration data, potentially weakening the firewall's protection and disrupting service availability.

Technologies: [Bunkerity BunkerWeb](https://junglewise.ai/threats/technologies/bunkerweb). Vendors: [Bunkerity](https://junglewise.ai/threats/vendors/bunkerity).

## Quick answers

**Is CVE-2026-61718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61718 being exploited in the wild.

**How severe is CVE-2026-61718?** Medium severity, with a CVSS score of 5.4, published 16 July 2026.

**Which products and versions are affected?** Bunkerity BunkerWeb 1.6.2 - 1.6.11.

**Is there a fix for CVE-2026-61718?** A patch was published on 2026-06-12: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61718 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61718?** Check whether you run Bunkerity BunkerWeb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in the BunkerWeb web UI's BiscuitMiddleware. The middleware's bypass list incorrectly included the '/cache/' URL prefix, causing requests to routes in 'src/ui/app/routes/cache.py' to skip permission checks. While these routes were protected by a '@login_required' decorator, they lacked specific role-based access control (RBAC) checks. Consequently, an authenticated user with only 'reader' (read-only) privileges could successfully execute a 'POST /cache/delete' request. This allows the permanent deletion of job cache files containing sensitive data such as DNSBLs, GeoIP databases, ModSecurity CRS rules, and ACME/Let's Encrypt material. The issue is resolved in version 1.6.12 by removing the prefix from the bypass list and enforcing proper authorization.

## Affected products

- Bunkerity BunkerWeb 1.6.2 - 1.6.11

## Timeline

- 2026-06-12: patched: Fix committed to repository
- 2026-07-02: advisory: Version 1.6.12 released
- 2026-07-08: disclosed: GitHub Security Advisory published
- 2026-07-16: advisory: NVD record published

## References

- [https://github.com/bunkerity/bunkerweb/commit/685ccbbe7d204132a843a7b7fd802d1bdb3f20a9](https://github.com/bunkerity/bunkerweb/commit/685ccbbe7d204132a843a7b7fd802d1bdb3f20a9)
- [https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.12](https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.12)
- [https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q7rm-935c-v39g](https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q7rm-935c-v39g)

## Related threats

- [BunkerWeb rDNS spoofing bypass in blacklist/greylist/antibot](https://junglewise.ai/threats/cve-2026-75514-bunkerweb-rdns-spoofing-bypass-in-blacklist-greylist-antibot)
- [Bunkerity BunkerWeb privilege escalation in UI and API](https://junglewise.ai/threats/cve-2026-54728-bunkerity-bunkerweb-privilege-escalation-in-ui-and-api)