Executive brief
A deployment mode designed to expose only read-only access to stored data inadvertently exposes certain API routes without proper HTTP method restrictions. This allows authenticated users in a read-only deployment to create or overwrite stored records using the application's own backend credentials, bypassing intended access controls. An attacker can forge or modify security-critical data that should be immutable in read-only mode, potentially compromising data integrity and audit trails.
Technical details
This vulnerability is an access control bypass resulting from insufficient HTTP method restrictions on API routes in a read-only deployment mode. The affected API routes accept POST/PUT/DELETE requests without validating whether the deployment mode should permit write operations, allowing authenticated users to create or overwrite stored records. The vulnerability requires the attacker to be authenticated and have access to the read-only deployment interface. An attacker can exploit this to forge records, overwrite security logs, or modify data that should be immutable, circumventing role-based access controls intended for the read-only deployment mode. The issue stems from the API proxy layer failing to enforce HTTP method restrictions based on deployment mode.
Affected products
- <UNKNOWN>
Timeline
- 2026-09-11: disclosed
- 2026-09-11: advisory: CISA ICSA-26-254-01