CVE-2026-110618 SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API
Unauthenticated attackers can access remote control APIs to read SMS, logs, and contacts, or modify configurations in SmsForwarder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110618?
CVE-2026-110618 is a high-severity missing authorization vulnerability in pppscn SmsForwarder, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.
Weakness: CWE-306
Which versions are affected by CVE-2026-110618?
How do I fix CVE-2026-110618?
No fix has been published for CVE-2026-110618 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-110618 being exploited?
There is no known exploitation of CVE-2026-110618 in the wild and no public exploit code.
Sources
Also known as GHSA-36x4-vgqr-2ffc.