CVE-2026-40584

CVE-2026-40584 affects RansomLook versions prior to 1.9.0, a tool designed to monitor ransomware groups and their victim markets. The vulnerability exists in the application's API within the genericapi.py file, where improper filtering of private location entries allows unauthorized disclosure of non-public location data. This occurs because the code removes elements from a list while iterating over it, causing some entries marked as private to be unintentionally retained in API responses. The vulnerability presents a moderate risk with a FAUCET Risk Score of 46.0 out of 100. While specific CVSS metrics are not available, the issue fundamentally represents an information disclosure vulnerability with potential network-based access, though exploitation would require knowledge of the API structure and authenticated or direct API access capabilities. The vulnerability is not currently being actively exploited in the wild, as evidenced by its absence from the Known Exploited Vulnerabilities catalog and its inactive status on public threat tracking lists. The EPSS score of 0.00042 indicates minimal likelihood of exploitation in the near term. However, organizations running RansomLook should prioritize upgrading to version 1.9.0 to prevent potential exposure of sensitive location information related to ransomware victims.