GHSA-6f5r-5672-72j7: @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

Summary @andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default (*:3080 / 0.0.0.0:3080) instead of localhost-only, and its document-management API endpoints do not require authentication. As a result, any network-reachable client on the same LAN, VM network, or container bridge can access the document-admin API without credentials. In my reproduction, I was able to enumerate documents, add a document, read its full content, search across the corpus, and delete the document through the host's LAN IP. The issue is not that a Web UI exists. The issue is that a local document-management Web UI/API is exposed on all interfaces by default without authentication. Details The README documents that the Web UI starts automatically and tells users to open: http://localhost:3080 It also documents START_WEB_UI=true and WEB_PORT=3080 as the defaults. The vulnerable behavior appears to come from starting the web server without binding it to localhost explicitly. In src/server.ts, the Web UI is started unless START_WEB_UI=false: if (process.env.START_WEB_UI !== 'false') { initializeDocumentManager().then(manager => { return startWebServer(undefined, manager); }).then(() => { console.error('[Server] Web UI started (port=' + (process.env.WEB_PORT || '3080') + ')'); })... } In src/web-server.ts, the Express app appears to listen with only the port: const server = app.listen(PORT, () => { console.log(\n 🌐 MCP Documentation Server - Web UI); console.log( ────────────────────────────────────); console.log( Local: http://localhost:${PORT}); console.log( Network: http://0.0.0.0:${PORT}\n); }); With Express/Node, app.listen(PORT) without a host argument binds to all interfaces. In my reproduction, this resulted in: LISTEN 0 511 *:3080 *:* users:(("MainThread",pid=1781375,fd=21)) The exposed API includes document-admin operations such as: GET /api/docu