Which versions of cc-connect are affected by CVE-2026-92801?

cc-connect versions through 1.5.0 contain a high-severity authorization bypass that allows any authenticated user in an admitted Feishu chat to dispatch agent commands via interactive card actions,…

How to fix or mitigate CVE-2026-92801?

Within 24 hours, verify whether cc-connect version 1.5.0 or earlier is in use and identify all Feishu chats admitted to the deployment; restrict chat membership to only fully trusted users and disable interactive card actions if possible. Within 7 days, implement monitoring for onCardAction events and agent command dispatches, and apply network segmentation to limit cc-connect's access to sensitive systems. Within 30 days, request a vendor patch timeline and, if none is provided, evaluate alternative solutions or custom authorization checks for the onCardAction handler; continue to audit Feishu chat logs for anomalous activity.

cc-connect CVE-2026-92801

Q: What is the CVSS score of CVE-2026-92801?

CVE-2026-92801 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-81061 HIGH

Incorrect Authorization (CWE-863)

2026-09-16 VulnCheck

GHSA-2qg4-97v5-72x5

Authentication Bypass Cc Connect

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 21:49 vuln.today

CVE Published

Sep 16, 2026 - 20:32 cve.org

HIGH 8.7

DescriptionCVE.org

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.

AnalysisAI

Incorrect authorization in cc-connect through 1.5.0 allows an authenticated, low-privileged user who can trigger Feishu interactive card actions inside an admitted chat to dispatch agent commands, because the onCardAction handler never applies the per-user allowlist that the text message handler enforces. The result is an authorization bypass (CWE-863) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N, with high confidentiality, integrity and availability impact confined to the cc-connect scope), meaning a participant who should not be permitted to drive the agent can still do so remotely without user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment

This is a genuine but access-gated authorization flaw, not a high-CVSS-but-low-risk paper cut. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.

Remediation

Patch status: no vendor-released fix version is identified in the available data, so the reference point is the upstream issue https://github.com/chenhg5/cc-connect/issues/1852 and the source at https://github.com/chenhg5/cc-connect/blob/v1.5.0/platform/feishu/feishu.go#L661-L680; operators should track the repository for a release newer than 1.5.0 and upgrade as soon as one is published, confirming the fix by testing that a non-allowlisted Feishu user cannot trigger agent commands via a card action. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, verify whether cc-connect version 1.5.0 or earlier is in use and identify all Feishu chats admitted to the deployment; restrict chat membership to only fully trusted users and disable interactive card actions if possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.