Executive brief
An application's access control mechanism defaults to granting access to authenticated users when a request handler is not explicitly registered in its role-permission table. This means any newly added feature or administrative function is accessible to all authenticated users regardless of their assigned role until explicitly restricted. An attacker with basic login credentials could access sensitive administrative functions or data they should not have permission to view.
Technical details
The vulnerability is an authorization bypass caused by fail-open default logic in role-based access control (RBAC). When a request handler name is not found in the role requirement lookup table, the application grants access instead of denying it. This affects all request handlers not explicitly registered in the authorization table, and any newly added handler remains accessible to all authenticated users until added to the table. The attack requires prior authentication and does not require network access to additional services—only knowledge that unregistered endpoints exist. An attacker can reach unintended administrative or sensitive functions. The fix involves changing the default logic to deny-by-default and explicitly registering all handlers with their required roles.
Timeline
- 2026-09-11: disclosed