CVE-2026-54551

Overview

WireGuard Portal (wg-portal) versions 2.2.0 through 2.2.x contain an authorization bypass vulnerability in the WebSocket statistics endpoint. Low-privileged users can subscribe to traffic statistics events and enumerate peer public keys across different user accounts. This exposes sensitive metadata and interface names normally restricted to administrators.

Description

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpoint_websocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdated and forwards every TrafficDelta event without per-user authorization in handleWebsocket(). A low-privilege user can enumerate peer public keys through EntityId and monitor BytesReceived and BytesTransmitted values for peers belonging to other users. The same connection exposes interface_stats and interface names that the REST API limits to administrators. Tunnel content, AllowedIPs, and user identities remain authorization-gated. This issue is fixed in version 2.3.0.

Impact

This vulnerability compromises confidentiality by allowing unauthorized low-privileged users to view traffic statistics, byte counts, and peer public keys belonging to other users. While tunnel content and user identities remain protected, administrative interface statistics are prematurely exposed. Organizations utilizing affected versions risk internal reconnaissance and metadata leakage across multi-tenant environments.

Remediation

Upgrade WireGuard Portal (wg-portal) to version 2.3.0 or later immediately where the authorization checks for the WebSocket statistics endpoint have been properly implemented. As a temporary workaround, restrict access to the web portal to trusted administrative networks or disable low-privileged user account creation until patching can be completed.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 4.3, as it requires prior authentication and does not allow full remote code execution or access to tunnel payloads. EPSS data is not currently available, but defenders should prioritize patching to maintain strict tenant isolation and protect internal metadata.

Affected products

• WireGuard Portal wg-portal 2.2.0
• WireGuard Portal wg-portal 2.2.x