Environment variable injection in OpenClaw's CLI backend runner enables local attackers to achieve arbitrary code execution or exfiltrate sensitive data by manipulating workspace configuration files. Attackers with the ability to supply malicious workspace configs can inject environment variables into backend processes during spawning, exploiting CWE-15 (external control of system or configuration setting). Vendor patch available via GitHub commit c2fb7f1. CVSS 8.5 reflects high impact across confidentiality, integrity, and availability, though exploitation requires local access and user interaction to load the malicious workspace config. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Local attackers can execute malicious code in OpenClaw versions before 2026.3.31 by placing crafted .env files in workspaces to override the OPENCLAW_BUNDLED_PLUGINS_DIR variable, bypassing plugin trust verification. The vulnerability enables code injection through untrusted plugins masquerading as verified components when users open compromised workspace configurations. EPSS data not available; CVSS v4.0 rates this 8.5 HIGH with local attack vector requiring user interaction. Vendor patch available via GitHub commit 330a9f98cb and release 2026.3.31.
Privilege escalation in OpenClaw chat.send API allows low-privileged gateway callers with write scope to execute admin-only session management operations. Attackers can forcibly reset user sessions, rotate session IDs, and archive chat transcripts without admin authorization by exploiting broken access control in the chat messaging path. This enables session hijacking and data manipulation attacks against legitimate users. Reported by VulnCheck disclosure team with vendor security advisory published; no public exploit or active exploitation confirmed at time of analysis.
Unquoted service path vulnerability in AVACAST by eMPIA Technology enables local privilege escalation from high-privileged user to SYSTEM. Attackers with administrative access can plant malicious executables in unquoted paths, achieving arbitrary code execution with system-level privileges upon service restart. Taiwan CERT (TWCERT) published advisories confirming the vulnerability. No public exploit code identified at time of analysis, and exploitation requires existing administrative privileges, limiting practical risk to environments where privileged user compromise is a concern.
Client-side authentication bypass in mpGabinet 23.12.19 and earlier allows local authenticated attackers to impersonate arbitrary users by patching the application binary. An attacker with legitimate low-privilege access to the system can manipulate the compiled application code to skip login verification entirely, gaining unauthorized access as any user including administrators. EPSS score not available for this 2026 CVE; no active exploitation or public POC confirmed at time of analysis.
Sandbox escape in Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted HTML to the Feedback component, which insufficiently validates untrusted input. The flaw (CWE-20, Chromium severity High, CVSS 8.3 with a scope change) is a second-stage privilege boundary bypass rather than an initial-access bug. No public exploit is identified at time of analysis, and the EPSS score is very low (0.05%, 14th percentile), consistent with a vulnerability that requires a prior renderer compromise to reach.
Sandbox escape in Google Chrome for Android (Media component) prior to 147.0.7727.138 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Chromium rates the severity High and a vendor patch is available; no public exploit is identified, EPSS is very low (0.01%, 1st percentile), and SSVC records exploitation status 'none'. It is a second-stage escape rather than an initial-access primitive, so it must be chained with a prior renderer compromise to have real impact.
Sandbox escape in Google Chrome's WebMIDI component (versions prior to 147.0.7727.138) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and carrying a CVSS of 8.3 with a scope-change (S:C) impact, it is a use-after-free (CWE-416) that Google has patched in the Stable channel. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.
Heap buffer overflow in Chrome's Skia graphics library (versions prior to 147.0.7727.138) lets an attacker who has already compromised the renderer process escape the sandbox via a crafted HTML page, reported by Google's own Chrome team. Chromium rates it High severity and a vendor patch is available, but there is no public exploit identified at time of analysis and EPSS is near zero (0.01%). SSVC records exploitation as none, meaning this is a defense-in-depth second-stage bug rather than a standalone entry point.
TSIG authentication bypass in CoreDNS before v1.14.3 allows unauthenticated network attackers to defeat TSIG protections on the gRPC, QUIC, DoH, and DoH3 transports and reach TSIG-gated functionality such as AXFR/IXFR zone transfers and dynamic updates. The gRPC/QUIC paths validate only the TSIG key name and never call dns.TsigVerify(), while DoH/DoH3 hardcode TsigStatus() to nil so any TSIG record - even one with an invalid key name and garbage MAC - is treated as verified. A detailed PoC demonstrates full zone dumps over forged requests; this is confirmed actively exploited status is not present (no public exploit identified at time of analysis beyond the reporter's PoC), and EPSS is low at 0.05%.
Improper authorization in CoreDNS' transfer plugin (versions before 1.14.3) lets a remote client bypass a restrictive subzone AXFR/IXFR ACL and dump the subzone's full contents. The flaw stems from longestMatch() selecting the transfer stanza by lexicographic string comparison instead of true longest-suffix match, so a permissive parent-zone rule can override a stricter child-zone rule for certain zone names. Publicly available exploit code exists (author-provided PoC) but there is no evidence of active exploitation, and EPSS is very low at 0.04%.
Authentication bypass in Netmaker (Gravitl) versions prior to 1.5.0 lets remote unauthenticated attackers forge host JWTs because VerifyHostToken in logic/jwts.go never validates the token signature. An attacker can sign a token with any arbitrary key to impersonate any host and reach host-scoped API endpoints, exposing sensitive network topology and peer information. SSVC lists a public proof-of-concept and rates the flaw automatable; EPSS is low (0.04%) and it is not on CISA KEV, so publicly available exploit code exists but no active exploitation is confirmed.
Webhook replay attacks in OpenClaw before 2026.3.28 allow remote attackers to trigger duplicate voice-call processing by reordering query parameters in captured Plivo V3 signed webhooks. The vulnerability stems from inconsistent canonicalization: signature verification sorts query parameters before validation, but replay detection hashes the raw URL with original parameter ordering. Attackers possessing a single valid signed webhook can bypass replay cache indefinitely by permuting query string order, causing repeated execution of voice-call workflows without requiring authentication or cryptographic breaks. No public exploit identified at time of analysis, though attack complexity is low (CVSS AC:L) with network vector (AV:N) requiring no privileges (PR:N).
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigger denial of service and disclose limited memory contents via malformed skip() operations during protocol deserialization. Affects all versions prior to 0.23.0, with publicly disclosed exploit details on oss-security mailing list. EPSS exploitation probability remains low (5th percentile) despite network-accessible attack vector, suggesting limited real-world targeting to date. Vendor patch released in version 0.23.0 addresses all six concurrently disclosed Thrift vulnerabilities (CVE-2026-41602 through CVE-2026-41607).
Out-of-bounds memory access in Google Chrome's Tint shader compiler (part of the Dawn/WebGPU stack) affects desktop builds prior to 147.0.7727.138 and lets a remote attacker who lures a victim to a crafted HTML page read or corrupt memory outside intended bounds. Rated High by Chromium and CVSS 8.1, it requires user interaction (visiting a page) but no authentication. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but the technical impact is total per CISA SSVC.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component affects all desktop versions prior to 147.0.7727.138, where a use-after-free flaw lets a remote attacker corrupt memory and run arbitrary code by sending malicious network traffic to an active remote-desktop session. Google rates it High severity; there is no public exploit identified at time of analysis and it is not in CISA KEV, with an EPSS probability of only 0.01% (2nd percentile). A vendor patch is available, and SSVC scores exploitation as none but technical impact as total.
Remote code execution in OpenClaw gateway versions before 2026.3.31 allows attackers with trusted paired node credentials (role=node) to escalate privileges and execute arbitrary code on the gateway by abusing unrestricted agent.request dispatch functionality. The vulnerability stems from insufficient access controls on node.event agent requests, enabling low-privilege paired nodes to invoke gateway-side tools without restriction. EPSS exploitation probability and KEV status not yet available for this recently disclosed vulnerability, but a vendor patch and exploit details are publicly documented.
Privilege escalation in OpenClaw's trusted-proxy authentication mode allows low-privileged authenticated users to gain operator.admin privileges by declaring operator scopes on non-Control-UI clients. The incomplete scope-clearing mechanism fails to sanitize self-declared scopes when identity-bearing authentication paths process requests, enabling attackers to bypass authorization checks and achieve full administrative access. Vendor patch available via commit 8b88b927 in version 2026.3.31; no confirmed active exploitation (not in CISA KEV) but publicly disclosed with detailed GitHub security advisory increasing attack feasibility.
Explicit-approval bypass in OpenClaw before 2026.4.8 lets an attacker with low-privileged access to gateway or node exec hosts run inline eval commands that the strictInlineEval control is supposed to gate behind manual user approval. The flaw is a fail-open approval-timeout fallback: when an approval prompt is not answered in time, the system permits the eval instead of denying it, defeating the intended trust boundary. No public exploit identified at time of analysis; EPSS is very low (0.04%, 12th percentile) and CISA SSVC records no observed exploitation, though technical impact is rated total.
Improper authorization in OpenClaw's device.token.rotate function (versions before 2026.4.8) lets a low-privileged actor mint or preserve device tokens carrying roles and scopes that never passed the intended role-upgrade pairing approval, effectively escalating privilege within the assistant's trust model. The flaw was reported by VulnCheck and Tencent Zhuque Lab and carries a CVSS 4.0 base score of 7.7 (High), but there is no public exploit identified at time of analysis and EPSS is negligible (0.04%, 11th percentile). SSVC rates exploitation as none and automatable as no, while technical impact is total.
Cross-workspace document disclosure in Outline (getoutline) versions 0.86.0 through 1.6.x lets an authenticated user mint a public share link for any document on the platform, then read its full contents. The flaw is an insecure direct object reference (IDOR) in the shares.create API: when a request supplies both collectionId and documentId, authorization validates only the collection and never checks that the caller may access the named document, so it works even against documents in other workspaces. A proof-of-concept is referenced by the GitHub advisory (SSVC 'poc'), but EPSS is very low (0.03%, 7th percentile) and it is not in CISA KEV, so this is publicly demonstrated but not confirmed as actively exploited.
Sandbox escape in OpenClaw file synchronization before version 2026.3.31 enables remote authenticated attackers to read and write arbitrary files outside intended boundaries via crafted symlinks during mirror sync operations. The vulnerability exploits CWE-59 (Improper Link Resolution Before File Access) with attack complexity rated High and requires low privileges, indicating targeted exploitation scenarios. Vendor patches available via GitHub commits c02ee8a and 3b9dab0, with CVSS 7.6 reflecting high confidentiality and integrity impact but no availability impact. No active exploitation or public POC identified at time of analysis beyond vendor disclosure.
Persistent browser-profile tampering in OpenClaw before 2026.4.8 lets a low-privileged actor reach the node.invoke(browser.proxy) code path, which fails to enforce the browser.request persistent profile-mutation guard. Because OpenClaw is a user-controlled local assistant, an actor able to drive node.invoke can rewrite persisted browser configuration (notably proxy settings) that the guard was meant to protect. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 7th percentile), and CISA SSVC records no observed exploitation.
Remote denial of service in MIT Kerberos 5 (krb5) before 1.22.3 allows an unauthenticated network attacker to crash any application that calls gss_accept_sec_context() on a host where a NegoEx mechanism is registered in /etc/gss/mech. A crafted NegoEx token triggers an integer underflow leading to an out-of-bounds read in parse_message(), terminating the GSS-API acceptor process. No public exploit is identified at time of analysis, EPSS risk is low (0.07%), and CISA SSVC scores exploitation as 'none'.
Remote denial of service in MIT Kerberos 5 (krb5) before 1.22.3 lets an unauthenticated attacker crash any GSS-API acceptor that has a NegoEx mechanism registered in /etc/gss/mech. Sending a malformed NegoEx token to an application that calls gss_accept_sec_context() triggers a NULL pointer dereference in parse_nego_message, terminating the process (CWE-476). No public exploit identified at time of analysis; EPSS is low (0.07%) and CISA SSVC lists exploitation as proof-of-concept only, with technical impact rated partial and not automatable.
Sandbox escape in Google Chrome for Windows (versions prior to 147.0.7727.138) stems from a use-after-free in the Views UI component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader code execution on the host via a crafted HTML page. Chromium rates the internal severity as Critical, though the assigned CVSS is 7.5 due to the high attack complexity and the renderer-compromise prerequisite. This is a second-stage bug: there is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and it is not listed in CISA KEV.
Remote unauthenticated access to sensitive data in VEGA VEGAPULS 6X Two-Wire industrial sensors exposes hashed credentials and access codes via unsecured configuration interface. Network-accessible interface (AV:N/AC:L/PR:N/UI:N) allows attackers to extract authentication materials without any prerequisites, enabling credential cracking and potential lateral movement in industrial networks. EPSS and KEV data not available; CERTVDE advisory confirms vulnerability in Ethernet-APL enabled industrial level measurement devices running PROFINET, Modbus TCP, and OPC UA protocols. No public exploit identified at time of analysis, though exploitation trivial due to lack of authentication requirement.
Information disclosure in Mozilla Firefox, Firefox ESR 140, and Firefox ESR 115 allows remote unauthenticated attackers to extract sensitive data via incorrect boundary conditions in the Audio/Video component. The vulnerability permits network-based exploitation with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), enabling unauthorized access to high-confidentiality information. Mozilla released patches in Firefox 150.0.1, Firefox ESR 140.10.1, and Firefox ESR 115.35.1 (confirmed by vendor advisories MFSA2026-35/36/37). SSVC indicates automatable exploitation with partial technical impact, though no public exploit or active exploitation is identified at time of analysis.
Predictable secret generation in Spring Boot's random value property source allows remote, unauthenticated attackers to obtain potentially sensitive values. Affected versions include Spring Boot 4.0.0 to 4.0.5, 3.5.x, 3.4.x, 3.3.x, and 2.7.x before the respective patch releases. The vulnerability has a CVSS score of 7.5 (High) but no active exploitation has been confirmed, and EPSS suggests a very low likelihood of exploitation.
Integer overflow in Apache Thrift's Go TFramedTransport implementation allows remote unauthenticated attackers to crash server processes via specially crafted uint32 values. Affects all Thrift versions prior to 0.23.0 with EPSS score of 0.02% (low exploitation probability). This is one of six related vulnerabilities disclosed simultaneously affecting different Thrift language bindings (Go, Swift, Java, c_glib), indicating coordinated security audit findings. Vendor patch available in version 0.23.0 released April 2026.
Missing integrity verification in OpenClaw before 2026.4.8 (npm package 'openclaw', tracked by the vendor as B-M3) lets attackers deliver tampered or malicious ClawHub plugin archives that install without any archive- or per-file integrity check, compromising the local assistant environment. The flaw was reported by VulnCheck and Tencent Zhuque Lab and is fixed in 2026.4.8; there is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile). Because OpenClaw is a user-controlled local assistant, exploitation requires the victim to install a plugin whose download an attacker can substitute or tamper with.
Remote unauthenticated denial of service in Apache Thrift c_glib language bindings (versions before 0.23.0) allows attackers to crash Thrift servers via specially crafted requests triggering 'free(): invalid pointer' fatal errors. CVSS 7.5 (HIGH) with network vector and low complexity. EPSS score is only 0.02% (4th percentile), indicating very low real-world exploitation probability despite theoretical severity. No active exploitation confirmed (not in CISA KEV); no public POC identified at time of analysis. Vendor-released patch: Apache Thrift 0.23.0.
Heap corruption in the GPU component of Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process escalate impact via a use-after-free triggered by a crafted HTML page. This is a High-severity Chromium memory-corruption bug reported internally by Chrome, with a vendor patch shipped in the April 2026 stable channel update and no public exploit identified at time of analysis. EPSS is minimal (0.01%) and CISA SSVC records exploitation status as none, though technical impact is rated total.
Heap corruption in Google Chrome's Cast component (versions prior to 147.0.7727.138) allows an attacker positioned on the same local network segment to trigger a use-after-free via malicious network traffic, potentially leading to code execution within the browser process. The flaw was reported internally by the Chrome team and carries a High Chromium severity, but there is no public exploit identified at time of analysis and EPSS scores exploitation probability at effectively 0%. It is not listed in CISA KEV, and CISA's SSVC assessment marks exploitation as none and the attack as not automatable.
Sandboxed remote code execution in Google Chrome's Cast component affects all desktop builds prior to 147.0.7727.138, where a CWE-416 use-after-free lets an attacker on the same local network segment run arbitrary code inside the Chromium sandbox by sending malicious network traffic. Chromium rates the flaw High severity, but SSVC records no observed exploitation and EPSS is 0.00%, and no public exploit has been identified at time of analysis. Google has shipped a fixed Stable channel build.
Unauthenticated remote attackers can access sensitive documents containing personally identifiable information (PII) in Aranda Service Desk versions prior to 8.3.12 by exploiting predictable log file names in the Aranda File Server (AFS) component. Attackers retrieve daily activity logs from a publicly accessible directory to obtain direct virtual paths of uploaded files, then bypass access controls to download the documents. CISA SSVC framework confirms proof-of-concept code exists and the vulnerability is fully automatable, significantly lowering the barrier to exploitation despite no confirmed active exploitation at time of analysis.
Remote authenticated attackers can execute arbitrary code on D-Link DIR-825M routers (firmware 1.1.12) by sending specially crafted requests to the /boafrm/formWanConfigSetup endpoint with malicious submit-url parameters, triggering a buffer overflow in function sub_414BA8. Public proof-of-concept exploit code exists on GitHub (Kiciot/cve#3), significantly lowering exploitation barriers. While requiring authentication (PR:L), the network attack vector (AV:N) and low complexity (AC:L) enable remote compromise of affected devices with potential for complete device control (VC:H/VI:H/VA:H). No CISA KEV listing or EPSS data available at time of analysis.
Buffer overflow in D-Link DIR-825M 1.1.12 router allows authenticated remote attackers to achieve high-severity code execution via crafted submit-url parameter in VPN configuration interface. Public exploit code exists (CVSS 4.0 E:P) with technical details disclosed on GitHub, enabling remote compromise of router administrative functions by low-privileged authenticated users. CVSS 7.4 HIGH severity with network attack vector and low complexity indicates significant risk for internet-facing devices with default or weak credentials.
Apache Thrift Java TSSLTransportFactory fails to verify server hostnames in TLS connections, enabling man-in-the-middle attacks against versions prior to 0.23.0. This CWE-297 (improper certificate validation) vulnerability allows network attackers with high complexity positioning to intercept and modify encrypted communications without authentication. EPSS exploitation probability is low (0.01%, 1st percentile), with no KEV listing or public exploit code identified at time of analysis. Vendor patch available in Thrift 0.23.0.
Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated administrators to execute arbitrary code remotely via crafted file extension names. The vulnerability affects the file_exten.asp File Extension Handler component, with a publicly available exploit (E:P in CVSS vector). While requiring high-privilege access (PR:H), successful exploitation grants complete system control (VC:H/VI:H/VA:H), and the attack complexity is low (AC:L). No CISA KEV listing indicates targeted rather than widespread exploitation despite public POC availability.
Memory corruption in Mozilla Firefox 150.0.0, Firefox ESR 140.10.0/115.35.0 and Thunderbird 150.0.0/140.10.0 arises from a collection of memory safety bugs (CWE-119) that Mozilla assesses could, with sufficient effort, be leveraged to run arbitrary code. This is a batch 'memory safety' advisory (MFSA 2026-35 through 2026-39) tracking ~19 internally-found Bugzilla issues rather than a single weaponized flaw. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC records exploitation status as none.
Multiple memory corruption vulnerabilities in Firefox 150.0.0 and Thunderbird 150.0.0 enable remote code execution through memory safety bugs. Mozilla's security advisory confirms these flaws could allow arbitrary code execution with sufficient exploit development. No active exploitation confirmed at time of analysis, but SSVC framework rates this as automatable with partial technical impact. Vendor-released patch available in Firefox 150.0.1.
Memory corruption in Mozilla Firefox 150.0.0, Firefox ESR 140.10.0, Thunderbird 150.0.0 and Thunderbird ESR 140.10.0 stems from an out-of-bounds write (CWE-787) that Mozilla assessed as potentially exploitable for arbitrary code execution. Mozilla's own engineers discovered the bugs through internal fuzzing/auditing and shipped fixes in Firefox 150.0.1 and Firefox ESR 140.10.1; there is no public exploit identified at time of analysis and EPSS is very low (0.04%). The flaw affects the browser/mail-client rendering engine, so a victim who loads attacker-controlled web content is the realistic trigger despite the raw CVSS vector.
Out-of-bounds write in GNU C Library 2.2+ allows remote unauthenticated attackers to corrupt memory and potentially execute arbitrary code through specially crafted TSIG DNS records processed by deprecated ns_printrrf, ns_printrr, or fp_nquery functions. While these functions are deprecated, any application still using them for DNS record printing remains vulnerable to network-based attacks with low complexity and no authentication barriers. No public exploit identified at time of analysis, but the deprecated status suggests limited real-world exposure despite the network attack vector.
Privilege escalation via authentication bypass in OpenClaw before 2026.4.8 allows a previously paired node to reconnect and gain an expanded, exec-capable command set without satisfying the operator.admin re-pairing scope check. Rooted in CWE-863 (incorrect authorization), the flaw lets an attacker who was once paired execute privileged commands on the local assistant host. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is very low at 0.02% (6th percentile), consistent with a local, precondition-dependent issue rather than an internet-wide threat.
Integer overflow in Apache Thrift Swift Compact Protocol implementation versions prior to 0.23.0 enables remote unauthenticated attackers to achieve partial confidentiality, integrity, and availability impact. This is one of six related vulnerabilities disclosed simultaneously affecting multiple Apache Thrift language implementations (Swift, Node.js, C++, c_glib, Go). EPSS score of 0.02% (5th percentile) indicates low current exploitation probability, with no active exploitation confirmed by CISA KEV at time of analysis. Vendor-released patch version 0.23.0 addresses this and related Thrift implementation flaws.
Command injection in Zyxel DX3301-T0 and EX3301-T0 routers allows authenticated administrators to execute arbitrary OS commands by injecting malicious input into the DomainName parameter of DHCP configuration. Affects firmware versions through 5.50(ABVY.7.1)C0. Vendor Zyxel has published a security advisory with remediation guidance. EPSS data not available; no public exploit identified at time of analysis. While CVSS score is 7.2 (High), practical risk is constrained by requirement for admin-level authentication, limiting exposure to credential compromise or malicious insider scenarios.
Remote authenticated attackers can overwrite arbitrary files on OpenClaw servers by uploading malicious tar archives containing symbolic links to the SSH sandbox feature. The vulnerability allows escaping sandbox restrictions to modify critical system files, enabling potential remote code execution or denial of service. Affects OpenClaw versions before 2026.3.31. No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE.
Command injection via ipmitool in OpenStack Ironic through 25.0.0 allows authenticated operators with high privileges to trigger ipmitool execution when a console interface is configured in a non-default deployment, leading to high impact on confidentiality, integrity, and availability of the bare-metal provisioning node. No public exploit identified at time of analysis, EPSS is very low (0.07%, 20th percentile), and SSVC indicates no observed exploitation, consistent with a niche operator-level flaw rather than mass-scanning risk.
Authorization bypass in OpenClaw phone channel endpoints allows authenticated low-privilege users to arm or disarm phone-based alarm channels without required administrative rights. Versions prior to 2026.3.28 fail to validate operator.admin scope for /phone arm and /phone disarm API endpoints when accessed through external channels (CWE-863). Patch released via GitHub commit aa66ae1fc, with CVSS 7.1 reflecting network-accessible integrity impact requiring only low-privilege authentication. No active exploitation confirmed (not in CISA KEV); exploit development straightforward given simple API authorization flaw.