EUVD-2026-12216Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file examples/lambda-function-url/packages/api/models/TodoList.ts of the component API Endpoint. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
CVE-2026-4171 is an authorization bypass vulnerability in CodeGenieApp serverless-express affecting versions up to 4.17.1, where manipulation of the userId parameter in the API Endpoint component allows authenticated attackers to access or modify resources belonging to other users. A public proof-of-concept exploit exists, the vendor has not responded to early disclosure, and the vulnerability carries a CVSS score of 6.3 with exploitation rated as Probable (EPSS indicator); while not currently in CISA KEV, the combination of public POC availability and low attack complexity represents moderate real-world risk.
Technical ContextAI
The vulnerability exists in the serverless-express framework (CPE: cpe:2.3:a:codegenieapp:serverless-express:*:*:*:*:*:*:*:*), specifically within the API Endpoint component handling TodoList operations in examples/lambda-function-url/packages/api/models/TodoList.ts. The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a well-known authorization flaw where user-supplied input (userId parameter) is used directly to determine access rights without proper validation or enforcement of access control. The serverless-express framework is designed for AWS Lambda, making this particularly relevant for cloud-native applications. The vulnerability allows authenticated users (PR:L in CVSS vector) to bypass authorization checks by supplying arbitrary userId values, potentially gaining access to other users' TodoList resources without proper ownership verification.
RemediationAI
- action: Apply vendor patch; details: Patch version not explicitly specified in available intelligence; contact vendor or monitor CodeGenieApp security advisories for patched version > 4.17.1
- action: Immediate workaround; details: Implement server-side authorization checks in API Endpoint handlers to validate that the authenticated user's identity matches the userId parameter before granting access; never trust client-supplied userId values without verification against the authenticated session/JWT claims
- action: Code review; details: Audit TodoList.ts and all similar API endpoint handlers for CWE-639 patterns—ensure authorization logic uses authenticated user context (from JWT/session) rather than unsanitized request parameters
- action: Upgrade serverless-express; details: Downgrade to versions prior to 4.17.0 if patched version unavailable, or await patched release; monitor https://github.com/codegenieapp/serverless-express and vendor advisories
- action: WAF/API Gateway controls; details: Implement API Gateway authorization policies or AWS Lambda resource-based policies to restrict cross-user access patterns; add request validation rules to reject suspicious userId parameter manipulations
- action: Logging and monitoring; details: Enable audit logging on TodoList API calls to detect unauthorized userId access patterns; alert on attempts to access resources with mismatched userId vs. authenticated user ID
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today