🎯 New Report #3620006: Wallet RPC Restricted-Mode Policy Bypass
🔺Severity: High
👽 Reporter: usagirabbit
⭐️ Reputation: 163
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-03-21
⏰ Disclosed: 2026-08-17 09:16:13
📝 Summary: A vulnerability was discovered in the Monero wallet RPC server that allowed restricted-mode clients to perform non-view-only operations. The issue was caused by inconsistent enforcement of the restricted mode, which allowed clients to bypass the intended view-only access controls and perform state-changing actions such as creating wallets, closing wallets, and mutating wallet state. The vulnerability was confirmed to be present in multiple versions of the Monero software.
📂 Report JSON File: 3620006
@hackeronereports