WIMOOR CVE-2026-111691

Exploitation requires the attacker to send HTTP requests directly to WIMOOR's backend service ports, bypassing the API gateway that normally issues and signs the X-USERINFO header - the backend's UserInfoFilter trusts this header without verifying a signature. The concrete prerequisite is therefore network reachability to the un-fronted backend ports; where the gateway is the only ingress and backend ports are segmented/firewalled, the attack is not reachable. No authentication or user interaction is needed once the port is reachable (PR:N/UI:N), but the AT:P/AC:H metrics reflect that this direct-backend network position is the key limiting factor. Deployments that expose backend services only behind the signing gateway are effectively not exploitable.

This is a genuine high-severity authorization flaw (CWE-290, authentication bypass by spoofing), but its real-world risk is strongly gated by a network-positioning precondition that the CVSS 4.0 vector itself captures. The vendor vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N, 9.1) combines PR:N/UI:N (no credentials or user interaction, consistent with the unsigned-header forgery) against VC:H/VI:H (full read and modify of tenant data), yet raises AC:H and AT:P - the latter two reflect that an attacker must first reach the backend service ports directly, bypassing the gateway that normally signs/validates the X-USERINFO header. In a correctly segmented deployment those ports are not internet-exposed, which sharply reduces exploitability; the high score therefore assumes an attacker already has a network position (misconfiguration, internal access, or flat network) rather than open internet reach. No EPSS score, KEV listing, or explicit POC flag was provided in the input, so exploitation probability cannot be quantified from the data; however, a detailed public technical write-up (hackmd) and a VulnCheck advisory describe the exact bypass, meaning the method is publicly documented even if packaged exploit code is not confirmed. Net: a real priority for any WIMOOR operator whose backend ports are reachable outside the gateway, but lower practical risk where network segmentation is enforced - the gap between the 9.1 score and realistic risk is entirely the AT:P/AC:H reachability requirement.

An attacker with network reachability to WIMOOR's backend service ports (e.g., an internal user, a tenant on a flat network, or where the backend is inadvertently internet-exposed) sends a request carrying a forged, unsigned X-USERINFO header specifying an arbitrary companyid and a manager or admin usertype. Because UserInfoFilter trusts the header when the gateway is bypassed, the backend authorizes the request as that tenant/admin, letting the attacker read and modify other tenants' orders, finance data, and Amazon seller authorizations. No packaged exploit is confirmed in the input, but a public technical write-up documents the exact forgery technique.