The MiroFish application is vulnerable to a critical missing authentication flaw that allows unauthenticated remote attackers to perform destructive operations and exfiltrate sensitive project data.

The application fails to implement any authentication or authorization middleware for its REST API blueprints, specifically within the backend/app/init.py file. This allows any unauthenticated network-reachable user to interact with sensitive endpoints, including those that execute destructive file system operations or trigger expensive external API calls.

Successful exploitation poses a severe risk to data integrity and business continuity. An attacker can permanently delete all project files, reports, and simulation data, leading to significant data loss. Furthermore, the ability to trigger unauthorized simulation processes and LLM API calls can result in substantial financial damage through resource exhaustion and service disruption. While the CVSS score is 7.3, the potential for total data destruction and unauthorized process control suggests a higher operational risk.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the MiroFish API, ensuring it is not exposed to the public internet or untrusted networks.

Proactive Monitoring: Review application access logs for unexpected requests to /api/ endpoints, particularly those utilizing the DELETE or POST methods, which may indicate unauthorized attempts to delete projects or trigger processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway in front of the application to enforce authentication and block unauthorized requests to the vulnerable API routes until a permanent code-level fix is implemented.

Public Exploit Available: Yes, a detailed technical write-up containing reproduction steps and specific API endpoints has been published via the official project GitHub issue tracker.

The risk associated with this vulnerability is extreme due to the lack of any access control mechanisms. Organizations currently utilizing MiroFish must treat this as a high-priority incident and isolate the application from network access immediately. Continuous monitoring for unauthorized API activity is essential until the vendor provides a formal security update that implements mandatory authentication for all API endpoints.