EUVD-2026-37955
GHSA-36qg-x8h8-59g2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:M/U:X
Network-reachable API (AV:N), low complexity decoding trick (AC:L), requires any valid Chef 360 account (PR:L), no user interaction; scope changes as a low-priv principal gains admin authority, yielding full C/I/A impact.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
3DescriptionCVE.org
Impact
A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue is due to improper handling of URL-encoded paths during request processing. In certain scenarios, an authenticated request may bypass standard access controls gaining additional privileges, potentially allowing access to API endpoints that are intended to be restricted to higher-permissioned roles. The impact is limited to environments where the affected request patterns can be triggered and depends on specific deployment configuration and access controls in place. Resolution The issue has been addressed through product updates that improve request validation and enforce strict path normalization before authorization checks. Customers are advised to update to the latest available version containing the fix, version 1.7.1 or later.
AnalysisAI
Authorization bypass in Progress Chef 360 prior to version 1.7.1 allows authenticated users to access higher-privileged API endpoints by exploiting improper URL-encoded path handling during request processing. The flaw is a path traversal/normalization weakness (CWE-23) that lets standard access controls be circumvented before authorization checks run. No public exploit identified at time of analysis, but the vendor advisory confirms the issue and a fixed release is available.
Technical ContextAI
Chef 360 is Progress Software's enterprise platform for infrastructure automation, configuration management, and compliance. The root cause is CWE-23 (Relative Path Traversal) manifesting in the HTTP request pipeline: the application performs authorization decisions on a non-canonicalized request path, then later resolves URL-encoded sequences (e.g., %2e%2e, %2f) when dispatching the request to a handler. This mismatch between the path used for the authorization decision and the path used for routing lets a request appear to target a low-privilege route while actually being routed to a restricted, higher-privileged endpoint. The CPE cpe:2.3:a:progress_chef:chef360:*:*:*:*:*:*:*:* confirms the affected product is the Chef 360 application across all pre-fix versions.
RemediationAI
Vendor-released patch: Chef 360 1.7.1 - upgrade all Chef 360 deployments to version 1.7.1 or later, which adds strict URL path normalization before authorization checks per the Progress advisory at https://community.progress.com/s/article/Authentication-Bypass-via-URL-Encoded-Path-Traversal. Until the upgrade is applied, restrict network reachability to the Chef 360 API to trusted management networks and tighten account provisioning so that only operators who already warrant elevated trust hold valid Chef 360 credentials, accepting that this reduces self-service onboarding. As a stop-gap, deploy a reverse proxy or WAF rule in front of Chef 360 that decodes and canonicalizes request paths and blocks requests containing %2e%2e, %2f, %5c, or double-encoded variants before they reach the application; note this may break legitimate clients that legitimately URL-encode path segments, so test in staging first. Rotate API tokens and credentials of any low-privilege accounts that could have been used for abuse, and review audit logs for unexpected calls to administrative endpoints from non-admin principals.
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today