UnoPim EUVD-2026-70672

Exploitation requires a valid UnoPim admin-panel session - any admin role, including the minimum dashboard-only access, is sufficient. The attacker must be able to send authenticated HTTP POST or PUT requests to the integration management routes within the admin web interface. No non-default server configuration, special plugin, or feature flag is required; the vulnerable routes exist in all default UnoPim installations prior to v2.1.3. The primary limiting factor is that external, unauthenticated attackers cannot exploit this directly - access is restricted to parties who already hold at least one admin-tier credential, whether legitimately assigned or obtained via a prior compromise.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N) scoring 7.1 accurately captures the attack profile: network-accessible, no complexity, requires only low-privilege authentication, no user interaction, primary impact is integrity (VI:H) from unauthorized OAuth credential issuance. VC:L reflects that OAuth client credentials or integration metadata may be incidentally disclosed during the attack. The absence of EPSS data means exploitation probability cannot be precisely quantified, but the bypass mechanism is trivial - a direct HTTP POST to an unauthenticated-from-the-middleware's-perspective route - making it highly automatable once any admin credential is obtained. No CISA KEV listing and no public exploit tool have been identified, which bounds near-term mass-exploitation risk. The critical limiting factor is the PR:L requirement: external unauthenticated attackers cannot exploit this directly. The real-world threat model is insider escalation or post-compromise lateral movement within the admin tier. The researcher writeup and VulnCheck advisory are public, lowering the bar for reproduction by any party with admin access.

A catalog-editor admin with only product-management permissions authenticates to the UnoPim admin panel and directly sends a POST request to admin.configuration.integrations.store, which the Bouncer middleware passes without a permission check because the route is absent from the ACL map. The attacker then calls admin.configuration.integrations.generate_key to obtain valid OAuth client credentials tied to a higher-privileged integration owner, and uses those credentials to call the UnoPim API with escalated permissions beyond their assigned role. A public researcher writeup documents this flow, lowering the barrier for reproduction.