Executive brief
A bundled packet-analysis component in a security monitoring system is deployed with a read-only access mode to prevent authenticated users from modifying stored session records. However, a flaw in the access control rules allows authenticated users to bypass these restrictions and add or remove tags on session records—a capability that should be restricted to administrators. This undermines the intended read-only protection and could allow users to falsify or hide security monitoring data.
Technical details
The vulnerability exists in a read-only deployment mode of a packet-analysis component where access controls are intended to permit only query/read operations. The security controls deny write-capable routes by pattern matching, but this pattern is incomplete and fails to block API routes that modify tags attached to stored session records. Because the proxy configuration permits the HTTP methods used by tag-modification routes, an authenticated user can craft requests to add or remove tags, effectively modifying stored security data. This is a logic flaw in the access control enforcement rather than a cryptographic or protocol-level issue. The vulnerability requires authentication and network access to the component's interface; there is no evidence of active exploitation.
Affected products
- <UNKNOWN> <UNKNOWN> <UNKNOWN>
Timeline
- 2026-09-11: disclosed
- 2026-09-11: advisory