Is CVE-2024-31218 actively exploited?

No active exploitation of CVE-2024-31218 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-31218 be exploited remotely?

Yes. CVE-2024-31218 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-31218?

CVE-2024-31218 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2024-31218

CRITICAL

CVE-2024-31218

CWE-306Published: April 5, 2024· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and earlier are subject to Missing Authentication for Critical Function vulnerability. This vulnerability allows an unauthenticated attacker to send a HTTP request to the database (Pocketbase) admin API to create an admin account. The Pocketbase admin API does not check for authentication/authorization when creating an admin account when no admin accounts have been added. In its default deployment, Webhood does not create a database admin account. Therefore, unless users have manually created an admin account in the database, an admin account will not exist in the deployment and the deployment is vulnerable. Versions starting from 0.9.1 are patched. The patch creates a randomly generated admin account if admin accounts have not already been created i.e. the vulnerability is exploitable in the deployment. As a workaround, users can disable access to URL path starting with `/api/admins` entirely. With this workaround, the vulnerability is not exploitable via network.

NVD Source

Risk Analysis

Webhood versions 0.9.0 and earlier are vulnerable to a missing authentication flaw that allows unauthenticated attackers to create an admin account via the database API. This critical vulnerability allows full administrative takeover of the deployment.

No public exploit is known, and it is not in the CISA KEV. The vulnerability is remotely exploitable with low complexity.

Recommended Action

Upgrade to Webhood version 0.9.1 or later to ensure proper authentication is enforced for admin account creation.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2024-31218 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.