Wimoor
Monthly
Authentication bypass in WIMOOR through commit ec86736 allows remote attackers to impersonate any tenant and privilege level by forging an unsigned X-USERINFO header, enabling read and modification of other tenants' orders, finance data, and Amazon seller authorizations. Exploitation requires direct network access to backend service ports, bypassing the API gateway that normally signs the header; deployments where backend ports are segmented/firewalled are not exploitable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) captures this high-severity impact but gated by network positioning, and no public exploit has been identified at time of analysis.
Authentication bypass in WIMOOR through commit ec86736 allows remote attackers to impersonate any tenant and privilege level by forging an unsigned X-USERINFO header, enabling read and modification of other tenants' orders, finance data, and Amazon seller authorizations. Exploitation requires direct network access to backend service ports, bypassing the API gateway that normally signs the header; deployments where backend ports are segmented/firewalled are not exploitable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) captures this high-severity impact but gated by network positioning, and no public exploit has been identified at time of analysis.