Vulnerability-Lookup

CVE-2026-48599 (GCVE-0-2026-48599)

Vulnerability from cvelistv5 – Published: 2026-06-15 21:55 – Updated: 2026-09-24 21:04

Title

Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding

Summary

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body. In 'Elixir.GRPC.Server.Transcode':map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {"user_id": "victim"} when body: "*") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed. This issue affects grpc: from 0.8.0 before 1.0.0.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 14:45 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

EEF mitre root

References

5 references

URL	Tags
https://github.com/elixir-grpc/grpc/security/advi…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-48599.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-48599	related
https://github.com/elixir-grpc/grpc/commit/8aaf3d…	related
https://github.com/elixir-grpc/grpc/commit/33b6a0…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
elixir-grpc	grpc	Affected: 0.8.0 , < 1.0.0 (semver) cpe:2.3:a:elixir-grpc:grpc::::::::
elixir-grpc	grpc	Affected: 8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 , < 33b6a095dbc91c6dee3c7b90893d7d74952e82e4 (git) cpe:2.3:a:elixir-grpc:grpc::::::::

Date Public

2026-06-15 21:55

Credits

Peter Ullrich Paulo Valente Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48599",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T14:45:46.288762Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T14:46:09.673Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.GRPC.Server.Transcode\u0027"
          ],
          "packageName": "grpc",
          "packageURL": "pkg:hex/grpc",
          "product": "grpc",
          "programFiles": [
            "lib/grpc/server/transcode.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
            }
          ],
          "repo": "https://github.com/elixir-grpc/grpc",
          "vendor": "elixir-grpc",
          "versions": [
            {
              "lessThan": "1.0.0",
              "status": "affected",
              "version": "0.8.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.GRPC.Server.Transcode\u0027"
          ],
          "packageName": "elixir-grpc/grpc",
          "packageURL": "pkg:github/elixir-grpc/grpc",
          "product": "grpc",
          "programFiles": [
            "lib/grpc/server/transcode.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
            }
          ],
          "repo": "https://github.com/elixir-grpc/grpc",
          "vendor": "elixir-grpc",
          "versions": [
            {
              "lessThan": "33b6a095dbc91c6dee3c7b90893d7d74952e82e4",
              "status": "affected",
              "version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eHTTP-to-gRPC transcoding must be enabled.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "HTTP-to-gRPC transcoding must be enabled."
            }
          ],
          "value": "HTTP-to-gRPC transcoding must be enabled."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.0",
                  "versionStartIncluding": "0.8.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Paulo Valente"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "datePublic": "2026-06-15T21:55:28.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\u003c/p\u003e\n\u003cp\u003eIn \u003ccode\u003e\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5\u003c/code\u003e (\u003ccode\u003elib/grpc/server/transcode.ex\u003c/code\u003e), all three clauses use \u003ccode\u003eMap.merge/2\u003c/code\u003e with path bindings as the first argument, giving them the lowest merge precedence. A request such as \u003ccode\u003eGET /users/me/profile?user_id=victim\u003c/code\u003e (or a POST with \u003ccode\u003e{\"user_id\": \"victim\"}\u003c/code\u003e when \u003ccode\u003ebody: \"*\"\u003c/code\u003e) yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.8.0 before 1.0.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn `\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5` (`lib/grpc/server/transcode.ex`), all three clauses use `Map.merge/2` with path bindings as the first argument, giving them the lowest merge precedence. A request such as `GET /users/me/profile?user_id=victim` (or a POST with `{\"user_id\": \"victim\"}` when `body: \"*\"`) yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
            }
          ],
          "value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn \u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {\"user_id\": \"victim\"} when body: \"*\") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-460",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T21:04:08.766Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
        },
        {
          "name": "EEF CNA record for CVE-2026-48599",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48599.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-48599",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48599"
        },
        {
          "name": "Introducing commit 8aaf3d3 in elixir-grpc/grpc",
          "tags": [
            "related"
          ],
          "url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
        },
        {
          "name": "Fix commit 33b6a09 in elixir-grpc/grpc",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48599",
    "datePublished": "2026-06-15T21:55:28.702Z",
    "dateReserved": "2026-05-22T09:36:56.834Z",
    "dateUpdated": "2026-09-24T21:04:08.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48599",
      "date": "2026-09-27",
      "epss": "0.00339",
      "percentile": "0.24812"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.GRPC.Server.Transcode\u0027"
                ],
                "packageName": "grpc",
                "packageURL": "pkg:hex/grpc",
                "product": "grpc",
                "programFiles": [
                  "lib/grpc/server/transcode.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
                  }
                ],
                "repo": "https://github.com/elixir-grpc/grpc",
                "vendor": "elixir-grpc",
                "versions": [
                  {
                    "lessThan": "1.0.0",
                    "status": "affected",
                    "version": "0.8.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.GRPC.Server.Transcode\u0027"
                ],
                "packageName": "elixir-grpc/grpc",
                "packageURL": "pkg:github/elixir-grpc/grpc",
                "product": "grpc",
                "programFiles": [
                  "lib/grpc/server/transcode.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
                  }
                ],
                "repo": "https://github.com/elixir-grpc/grpc",
                "vendor": "elixir-grpc",
                "versions": [
                  {
                    "lessThan": "33b6a095dbc91c6dee3c7b90893d7d74952e82e4",
                    "status": "affected",
                    "version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn \u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {\"user_id\": \"victim\"} when body: \"*\") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
          }
        ],
        "id": "CVE-2026-48599",
        "lastModified": "2026-09-24T21:17:13.967",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-48599",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T14:45:46.288762Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-15T23:16:45.377",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-48599.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48599"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-48599",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-16T14:45:46.288762Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-16T14:46:05.524Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.GRPC.Server.Transcode\u0027"
              ],
              "packageName": "grpc",
              "packageURL": "pkg:hex/grpc",
              "product": "grpc",
              "programFiles": [
                "lib/grpc/server/transcode.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
                }
              ],
              "repo": "https://github.com/elixir-grpc/grpc",
              "vendor": "elixir-grpc",
              "versions": [
                {
                  "lessThan": "1.0.0",
                  "status": "affected",
                  "version": "0.8.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.GRPC.Server.Transcode\u0027"
              ],
              "packageName": "elixir-grpc/grpc",
              "packageURL": "pkg:github/elixir-grpc/grpc",
              "product": "grpc",
              "programFiles": [
                "lib/grpc/server/transcode.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
                }
              ],
              "repo": "https://github.com/elixir-grpc/grpc",
              "vendor": "elixir-grpc",
              "versions": [
                {
                  "lessThan": "33b6a095dbc91c6dee3c7b90893d7d74952e82e4",
                  "status": "affected",
                  "version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eHTTP-to-gRPC transcoding must be enabled.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "HTTP-to-gRPC transcoding must be enabled."
                }
              ],
              "value": "HTTP-to-gRPC transcoding must be enabled."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "1.0.0",
                      "versionStartIncluding": "0.8.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Paulo Valente"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "datePublic": "2026-06-15T21:55:28.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\u003c/p\u003e\n\u003cp\u003eIn \u003ccode\u003e\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5\u003c/code\u003e (\u003ccode\u003elib/grpc/server/transcode.ex\u003c/code\u003e), all three clauses use \u003ccode\u003eMap.merge/2\u003c/code\u003e with path bindings as the first argument, giving them the lowest merge precedence. A request such as \u003ccode\u003eGET /users/me/profile?user_id=victim\u003c/code\u003e (or a POST with \u003ccode\u003e{\"user_id\": \"victim\"}\u003c/code\u003e when \u003ccode\u003ebody: \"*\"\u003c/code\u003e) yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.8.0 before 1.0.0.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn `\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5` (`lib/grpc/server/transcode.ex`), all three clauses use `Map.merge/2` with path bindings as the first argument, giving them the lowest merge precedence. A request such as `GET /users/me/profile?user_id=victim` (or a POST with `{\"user_id\": \"victim\"}` when `body: \"*\"`) yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
                }
              ],
              "value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn \u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {\"user_id\": \"victim\"} when body: \"*\") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-460",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-24T21:04:08.766Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
            },
            {
              "name": "EEF CNA record for CVE-2026-48599",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-48599.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-48599",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48599"
            },
            {
              "name": "Introducing commit 8aaf3d3 in elixir-grpc/grpc",
              "tags": [
                "related"
              ],
              "url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
            },
            {
              "name": "Fix commit 33b6a09 in elixir-grpc/grpc",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-48599",
        "datePublished": "2026-06-15T21:55:28.702Z",
        "dateReserved": "2026-05-22T09:36:56.834Z",
        "dateUpdated": "2026-09-24T21:04:08.766Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48599

Vulnerability from fkie_nvd - Published: 2026-06-15 23:16 - Updated: 2026-09-24 21:17

Severity

7.6 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-48599.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-48599
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.GRPC.Server.Transcode\u0027"
          ],
          "packageName": "grpc",
          "packageURL": "pkg:hex/grpc",
          "product": "grpc",
          "programFiles": [
            "lib/grpc/server/transcode.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
            }
          ],
          "repo": "https://github.com/elixir-grpc/grpc",
          "vendor": "elixir-grpc",
          "versions": [
            {
              "lessThan": "1.0.0",
              "status": "affected",
              "version": "0.8.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.GRPC.Server.Transcode\u0027"
          ],
          "packageName": "elixir-grpc/grpc",
          "packageURL": "pkg:github/elixir-grpc/grpc",
          "product": "grpc",
          "programFiles": [
            "lib/grpc/server/transcode.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
            }
          ],
          "repo": "https://github.com/elixir-grpc/grpc",
          "vendor": "elixir-grpc",
          "versions": [
            {
              "lessThan": "33b6a095dbc91c6dee3c7b90893d7d74952e82e4",
              "status": "affected",
              "version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn \u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {\"user_id\": \"victim\"} when body: \"*\") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
    }
  ],
  "id": "CVE-2026-48599",
  "lastModified": "2026-09-24T21:17:13.967",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48599",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-16T14:45:46.288762Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-15T23:16:45.377",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-48599.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48599"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-MWR4-5G34-J5CQ

Vulnerability from github – Published: 2026-08-25 18:11 – Updated: 2026-08-25 18:11

Summary

gRPC Erlang package's path bindings are overridable by query string and request body

Details

Summary

In the HTTP-to-gRPC transcoding layer of the grpc Hex package, query-string and request-body parameters can silently overwrite path-bound fields when building the decoded protobuf request struct. An authenticated attacker who can reach a transcoded endpoint can substitute any path-bound identifier (e.g. user_id from /users/{user_id}/profile) with an arbitrary value, bypassing authorization, multi-tenancy, and ownership checks that rely on the path-derived field.

Details

All three clauses of GRPC.Server.Transcode.map_request/5 (grpc_server/lib/grpc/server/transcode.ex) use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. Path bindings are extracted by the router from the matched URL template and should be the authoritative resource identifiers, but query-string and body parameters overwrite them. The decoded protobuf struct handed to the handler carries the attacker's value instead of the router's.

PoC

Deploy a transcoded gRPC service with a route like GET /users/{user_id}/profile where the handler authorizes access based on request.user_id.
Send: GET /users/me/profile?user_id=victim
The decoded request struct has user_id = "victim" — the authorization check passes for the victim's resource, not the caller's.
Alternatively, for a POST with body: "*": send {"user_id": "victim"} in the JSON body.

Impact

Affects applications using grpc ≥ 0.8.0 with HTTP transcoding enabled that rely on path-bound fields for authorization or tenant isolation. Fixed in 1.0.0. An authenticated attacker can read or modify any other user's resources exposed via transcoded endpoints.

References

Introduction commit: https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048
Patch commit: https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4

Severity

7.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "grpc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.0"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48599"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T18:11:15Z",
    "nvd_published_at": "2026-06-15T23:16:45Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nIn the HTTP-to-gRPC transcoding layer of the `grpc` Hex package, query-string and request-body parameters can silently overwrite path-bound fields when building the decoded protobuf request struct. An authenticated attacker who can reach a transcoded endpoint can substitute any path-bound identifier (e.g. `user_id` from `/users/{user_id}/profile`) with an arbitrary value, bypassing authorization, multi-tenancy, and ownership checks that rely on the path-derived field.\n\n### Details\n\nAll three clauses of `GRPC.Server.Transcode.map_request/5` (`grpc_server/lib/grpc/server/transcode.ex`) use `Map.merge/2` with path bindings as the first argument, giving them the lowest merge precedence. Path bindings are extracted by the router from the matched URL template and should be the authoritative resource identifiers, but query-string and body parameters overwrite them. The decoded protobuf struct handed to the handler carries the attacker\u0027s value instead of the router\u0027s.\n\n### PoC\n\n1. Deploy a transcoded gRPC service with a route like `GET /users/{user_id}/profile` where the handler authorizes access based on `request.user_id`.\n2. Send: `GET /users/me/profile?user_id=victim`\n3. The decoded request struct has `user_id = \"victim\"` \u2014 the authorization check passes for the victim\u0027s resource, not the caller\u0027s.\n4. Alternatively, for a `POST` with `body: \"*\"`: send `{\"user_id\": \"victim\"}` in the JSON body.\n\n### Impact\n\nAffects applications using `grpc` \u2265 0.8.0 with HTTP transcoding enabled that rely on path-bound fields for authorization or tenant isolation. Fixed in 1.0.0. An authenticated attacker can read or modify any other user\u0027s resources exposed via transcoded endpoints.\n\n### References\n\n* Introduction commit: https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048\n* Patch commit: https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4",
  "id": "GHSA-mwr4-5g34-j5cq",
  "modified": "2026-08-25T18:11:16Z",
  "published": "2026-08-25T18:11:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48599"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-grpc/grpc/pull/541"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-48599.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/elixir-grpc/grpc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-grpc/grpc/releases/tag/v1.0.0"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48599"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "gRPC Erlang package\u0027s path bindings are overridable by query string and request body"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-48599 (GCVE-0-2026-48599)

FKIE_CVE-2026-48599

GHSA-MWR4-5G34-J5CQ

Summary

Details

PoC

Impact

References

Tags

Sightings

Nomenclature

Related by attack behaviour