Monthly
Severity signals and exploitation signals diverge here: Splunk SOAR deployments below 8.7.0 permit an authenticated low-privilege user to bypass authorization by supplying requests whose URL path is non-canonical, so the path used for the access-control decision differs from the path the application ultimately services (CWE-647), with CVSS 3.1 scoring the issue 8.8 and high confidentiality, integrity and availability impact. The exposure is limited to holders of valid SOAR credentials on the web interface (PR:L, AV:N, UI:N) and does not extend to anonymous remote attackers. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), and Cisco/Splunk has shipped a hardened 8.7.0 release that resolves the flaw.
Authorization bypass in Eclipse Arrowhead 5.0.0-5.2.1 allows any authenticated system - regardless of privilege level - to reach every protected management API endpoint by submitting percent-encoded paths that defeat the raw-URL substring check while still being routed by Spring MVC's decoded dispatcher. Exploiting the flaw is trivial: encoding a single character in '/mgmt/' (e.g. 'm' → '%6D') causes the filter to fall through without authorizing the request, yet Tomcat decodes and dispatches it normally. The highest-impact target is POST /authentication/mgmt/identities, which creates new sysop-level accounts, yielding full administrative takeover of the Arrowhead local cloud. No public exploit has been identified at time of analysis.
Home-directory hijacking in File Browser before 2.63.17 lets an unauthenticated attacker gain full read/write access to another user's files by registering a username that normalizes to a victim's scope. Because cleanUsername() is a many-to-one transform, distinct usernames such as team/one, team one, and team-one collapse to the same home directory, and the signup path never checked whether the derived scope was already owned. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix commit and a regression test are public, making the root cause well understood.
Authorization bypass in the Astro web framework version 6.4.7 lets remote unauthenticated attackers reach protected routes by exploiting an inconsistency between how the framework decodes URL paths for auth decisions versus route matching. Because authorization runs against a path that hit the iterative URL-decoder limit while later rewrite matching applies an extra decodeURI(), a request that appears benign at the auth gate resolves to a guarded route afterward, exposing protected content. No public exploit has been identified at time of analysis, but the fix in 6.4.8 and a published GitHub Security Advisory confirm the flaw.
Apache APISIX versions 2.14.1 through 3.18.0 can serve requests to protected upstream endpoints without authentication when a permissive (public) route overlaps the path space of a protected route and the client supplies a crafted encoded, non-canonical path. Because authorization is evaluated against the permissive route while the request ultimately resolves to the protected upstream, the protected route's policies are bypassed entirely; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a fully remote, unauthenticated attack that is gated only by the non-default requirement of an overlapping permissive-and-protected route configuration. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is fixed by upgrading to Apache APISIX 3.19.0.
Unauthorized access to protected functionality affects Dell Secure Connect Gateway (SCG) Policy Manager installations running versions prior to 5.34.00.16, where authorization decisions are made against non-canonical URL paths (CWE-647). Remote unauthenticated attackers (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) must craft an alternate but equivalent path representation that the Policy Manager's authorization logic normalizes differently from its request routing, allowing them to reach functions intended to be restricted - with only a limited integrity impact and no confidentiality or availability impact claimed by the vendor. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity (AC:H) reflects that this is not a generic single-request attack against default configuration, which is why the issue is assessed as low priority despite being network-reachable and unauthenticated.
Path confusion in Envoy Proxy lets remote, unauthenticated clients bypass path-based authorization and routing policy by attaching semicolon parameters to dot and dotdot segments - a request such as /user/..;foo=bar/admin is not canonicalized to /admin even when path normalization is enabled, so a client can present one path to Envoy's policy engine and a different effective path to the upstream. The security consequence materializes only when Envoy itself makes a path-based RBAC or routing decision on the uncollapsed value, or when a downstream/upstream collapses the segment per RFC 3986 while Envoy does not; without such a mismatch the exposure is limited to low-confidentiality impact. The issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1; no public exploit code was identified at time of analysis and no CISA KEV or EPSS signal was provided. Note that the attached tag reads 'Authentication Bypass', but the assessed impact is a moderate-severity access-control (path confusion) bypass, not an authentication bypass.
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an authenticated mesh workload to reach HTTP paths that are explicitly blocked by path-based deny intentions, when the service proxy is configured with a custom public listener. The flaw undermines a core service mesh security control - path-based L7 intentions - without requiring unauthenticated access or elevated privileges beyond mesh workload enrollment. No public exploit code has been identified and this CVE is not listed in CISA KEV; the CVSS 4.2 Medium score accurately reflects the configuration-dependent, authenticated nature of the attack.
Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an unresolved path (e.g., `/public/../admin/secret.txt`) to downstream web applications instead of the canonicalized form (e.g., `/admin/secret.txt`). Web applications that delegate path-based authorization decisions to Jetty-provided paths are susceptible to confusion attacks where an attacker crafts a URI like `/public;/../admin/secret.txt` to receive a path that bypasses application-layer access controls. Jetty itself is shielded by its alias checker and will not serve restricted files directly; the integrity risk materializes only in applications that consume the unresolved path for routing or authorization logic. No public exploit code or CISA KEV listing is present at time of analysis.
Credential leakage in Cargo's sparse index registry URL normalization affects all Cargo releases from 1.68 through 1.96. The flaw caused Cargo to incorrectly apply git-registry canonicalization rules - specifically, stripping `.git` suffixes and lowercasing GitHub paths - to sparse index protocol URLs (prefixed with `sparse+`). This allowed two distinct sparse registry URLs that differed only by a `.git` suffix to resolve to the same canonical identifier, meaning credentials configured for one registry could be transmitted to a different, attacker-controlled registry on the same domain. No public exploit identified at time of analysis; EPSS is 0.04% (12th percentile), consistent with the vendor-assessed low severity and SSVC exploitation status of none.
Severity signals and exploitation signals diverge here: Splunk SOAR deployments below 8.7.0 permit an authenticated low-privilege user to bypass authorization by supplying requests whose URL path is non-canonical, so the path used for the access-control decision differs from the path the application ultimately services (CWE-647), with CVSS 3.1 scoring the issue 8.8 and high confidentiality, integrity and availability impact. The exposure is limited to holders of valid SOAR credentials on the web interface (PR:L, AV:N, UI:N) and does not extend to anonymous remote attackers. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), and Cisco/Splunk has shipped a hardened 8.7.0 release that resolves the flaw.
Authorization bypass in Eclipse Arrowhead 5.0.0-5.2.1 allows any authenticated system - regardless of privilege level - to reach every protected management API endpoint by submitting percent-encoded paths that defeat the raw-URL substring check while still being routed by Spring MVC's decoded dispatcher. Exploiting the flaw is trivial: encoding a single character in '/mgmt/' (e.g. 'm' → '%6D') causes the filter to fall through without authorizing the request, yet Tomcat decodes and dispatches it normally. The highest-impact target is POST /authentication/mgmt/identities, which creates new sysop-level accounts, yielding full administrative takeover of the Arrowhead local cloud. No public exploit has been identified at time of analysis.
Home-directory hijacking in File Browser before 2.63.17 lets an unauthenticated attacker gain full read/write access to another user's files by registering a username that normalizes to a victim's scope. Because cleanUsername() is a many-to-one transform, distinct usernames such as team/one, team one, and team-one collapse to the same home directory, and the signup path never checked whether the derived scope was already owned. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix commit and a regression test are public, making the root cause well understood.
Authorization bypass in the Astro web framework version 6.4.7 lets remote unauthenticated attackers reach protected routes by exploiting an inconsistency between how the framework decodes URL paths for auth decisions versus route matching. Because authorization runs against a path that hit the iterative URL-decoder limit while later rewrite matching applies an extra decodeURI(), a request that appears benign at the auth gate resolves to a guarded route afterward, exposing protected content. No public exploit has been identified at time of analysis, but the fix in 6.4.8 and a published GitHub Security Advisory confirm the flaw.
Apache APISIX versions 2.14.1 through 3.18.0 can serve requests to protected upstream endpoints without authentication when a permissive (public) route overlaps the path space of a protected route and the client supplies a crafted encoded, non-canonical path. Because authorization is evaluated against the permissive route while the request ultimately resolves to the protected upstream, the protected route's policies are bypassed entirely; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a fully remote, unauthenticated attack that is gated only by the non-default requirement of an overlapping permissive-and-protected route configuration. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is fixed by upgrading to Apache APISIX 3.19.0.
Unauthorized access to protected functionality affects Dell Secure Connect Gateway (SCG) Policy Manager installations running versions prior to 5.34.00.16, where authorization decisions are made against non-canonical URL paths (CWE-647). Remote unauthenticated attackers (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) must craft an alternate but equivalent path representation that the Policy Manager's authorization logic normalizes differently from its request routing, allowing them to reach functions intended to be restricted - with only a limited integrity impact and no confidentiality or availability impact claimed by the vendor. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity (AC:H) reflects that this is not a generic single-request attack against default configuration, which is why the issue is assessed as low priority despite being network-reachable and unauthenticated.
Path confusion in Envoy Proxy lets remote, unauthenticated clients bypass path-based authorization and routing policy by attaching semicolon parameters to dot and dotdot segments - a request such as /user/..;foo=bar/admin is not canonicalized to /admin even when path normalization is enabled, so a client can present one path to Envoy's policy engine and a different effective path to the upstream. The security consequence materializes only when Envoy itself makes a path-based RBAC or routing decision on the uncollapsed value, or when a downstream/upstream collapses the segment per RFC 3986 while Envoy does not; without such a mismatch the exposure is limited to low-confidentiality impact. The issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1; no public exploit code was identified at time of analysis and no CISA KEV or EPSS signal was provided. Note that the attached tag reads 'Authentication Bypass', but the assessed impact is a moderate-severity access-control (path confusion) bypass, not an authentication bypass.
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an authenticated mesh workload to reach HTTP paths that are explicitly blocked by path-based deny intentions, when the service proxy is configured with a custom public listener. The flaw undermines a core service mesh security control - path-based L7 intentions - without requiring unauthenticated access or elevated privileges beyond mesh workload enrollment. No public exploit code has been identified and this CVE is not listed in CISA KEV; the CVSS 4.2 Medium score accurately reflects the configuration-dependent, authenticated nature of the attack.
Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an unresolved path (e.g., `/public/../admin/secret.txt`) to downstream web applications instead of the canonicalized form (e.g., `/admin/secret.txt`). Web applications that delegate path-based authorization decisions to Jetty-provided paths are susceptible to confusion attacks where an attacker crafts a URI like `/public;/../admin/secret.txt` to receive a path that bypasses application-layer access controls. Jetty itself is shielded by its alias checker and will not serve restricted files directly; the integrity risk materializes only in applications that consume the unresolved path for routing or authorization logic. No public exploit code or CISA KEV listing is present at time of analysis.
Credential leakage in Cargo's sparse index registry URL normalization affects all Cargo releases from 1.68 through 1.96. The flaw caused Cargo to incorrectly apply git-registry canonicalization rules - specifically, stripping `.git` suffixes and lowercasing GitHub paths - to sparse index protocol URLs (prefixed with `sparse+`). This allowed two distinct sparse registry URLs that differed only by a `.git` suffix to resolve to the same canonical identifier, meaning credentials configured for one registry could be transmitted to a different, attacker-controlled registry on the same domain. No public exploit identified at time of analysis; EPSS is 0.04% (12th percentile), consistent with the vendor-assessed low severity and SSVC exploitation status of none.