PT-2026-25386 · Cleanuparr+1 · Cleanuparr

Ppfeister · Published 2026-03-13 · Updated 2026-03-16 · CVE-2026-32702

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Cleanuparr versions 2.7.0 through 2.8.0

Description Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. The /api/auth/login endpoint has a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. The hashing function, which is the most time-consuming part of the process, occurs as part of the VerifyPassword function. Short circuits occurring before the hashing function introduce a timing differential that exposes validity to the attacker.

Recommendations Cleanuparr versions 2.7.0 through 2.8.0 should be updated to version 2.8.1.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-32702

GHSA-GJMF-M27R-2C9V

Affected Products

Cleanuparr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32702.json · Exploit
• 🔥 https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-gjmf-m27r-2c9v · Exploit
• https://osv.dev/vulnerability/CVE-2026-32702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32702 · Security Note
• https://twitter.com/CVEnew/status/2032605831942865112 · Twitter Post
• https://t.me/CVEtracker/47380 · Telegram Post