CVE-2026-48599: elixir-grpc authorization bypass in HTTP transcoding

Executive brief

gRPC is a remote procedure call framework used to build high-performance APIs. The HTTP transcoding feature allows gRPC services to be called via standard HTTP requests. A vulnerability in versions 0.8.0 through 0.9.x allows authenticated users to override security-critical resource identifiers (like user IDs) by adding them to query strings or request bodies, bypassing authorization checks and potentially exposing or modifying other users' data.

Technical details

The vulnerability exists in `GRPC.Server.Transcode.map_request/5` within the gRPC server's transcoding layer. The function uses `Map.merge/2` with path bindings as the first argument, giving them the lowest merge precedence. This allows query-string and JSON request-body parameters to overwrite authoritative path-bound fields extracted from the URL template. An authenticated attacker can craft requests with overridden identifiers (e.g., `GET /users/me/profile?user_id=victim` or `POST` with `{"user_id": "victim"}`) to bypass access controls that rely on the path-derived values. The decoded protobuf struct passed to the handler contains the attacker's value instead of the router's, leading to unauthorized read and modify operations on other users' resources. The fix was applied in version 1.0.0 to ensure path bindings take precedence over user-supplied parameters.

Affected products

• Elixir Community gRPC 0.8.0 through 0.9.x

Timeline

• 2026-06-15: disclosed: CVE-2026-48599 published to NVD
• 2026-08-25: advisory: GitHub advisory GHSA-mwr4-5g34-j5cq published
• 2026-06-15: patched: Fix available in gRPC version 1.0.0

References

• https://api.github.com/users/PJUllrich
• https://github.com/PJUllrich
• https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D
• https://api.github.com/users/PJUllrich/repos
• https://avatars.githubusercontent.com/u/10426523?v=4
• https://api.github.com/users/PJUllrich/events%7B/privacy%7D