EUVD-2026-54931
GHSA-g6p6-cjcx-6p6p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Lambda invocation but PR:H required; limited C/I/A impact confined to the vulnerable system with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Handler. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Improper privilege management in wongcyrus ExcelLexBot through version 0.0.3 allows remote high-privileged attackers to perform unauthorized actions via the ExcelLexBotS3TriggerFunction Lambda handler, resulting in limited confidentiality, integrity, and availability impact. The affected product is end-of-life and will receive no vendor patch, as the maintainer is no longer supporting it. No public exploit code or active exploitation has been identified at time of analysis, though the remote attack vector and absence of a patch increase residual risk for any remaining deployments.
Technical ContextAI
ExcelLexBot is a serverless application built on AWS Lambda, where ExcelLexBotS3TriggerFunction acts as an event-driven handler triggered by S3 bucket events. CWE-266 (Incorrect Privilege Assignment) indicates the root cause is improper assignment or management of privileges within the Lambda execution role or function logic - likely the function operates with overly broad IAM permissions or fails to enforce least-privilege boundaries, allowing a high-privileged caller to leverage the function in unintended ways. The serverless architecture means the attack surface is the Lambda invocation interface, which is network-reachable (AV:N per the CVSS 4.0 vector). No CPE strings were provided in the intelligence data.
RemediationAI
No vendor-released patch is available and none is expected, as the maintainer no longer supports this product. The primary remediation is migration away from ExcelLexBot entirely - organizations should replace the S3-triggered Lambda workflow with a supported alternative. If immediate migration is not feasible, restrict invocation of the ExcelLexBotS3TriggerFunction Lambda by tightening the associated IAM resource-based policy to the minimum required principals, reducing the pool of high-privileged callers who can trigger the function. Additionally, review and scope down the Lambda execution role's IAM permissions to enforce least privilege, limiting what the function can do if exploited. Enable AWS CloudTrail logging for Lambda invocations to detect anomalous calls. These controls reduce exposure but do not eliminate the underlying flaw. See VulDB advisory at https://vuldb.com/vuln/387214 for disclosure details.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today