{"id":"CVE-2026-107333","published":"2026-10-08T18:17:19.603","lastModified":"2026-10-08T21:03:43.847","description":"Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json","tags":[]},{"url":"https://github.com/cisagov/Malcolm/security/advisories/GHSA-v66f-cwcm-hf73","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json","tags":[]},{"url":"https://github.com/cisagov/Malcolm/security/advisories/GHSA-v66f-cwcm-hf73","tags":[]}],"hasPoc":true,"ai":{"summary":"A URL path normalization inconsistency in Malcolm's nginx reverse proxy allows authenticated users to bypass role-based access controls by crafting specially formatted request paths. This creates a path traversal-like vulnerability where users can access administrative endpoints they shouldn't have permission to reach.","exploitability":"The exploit is moderately easy to perform as it requires only an authenticated session and knowledge of the target endpoints, with no additional prerequisites or complex payloads needed.","blast_radius":"If exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive administrative interfaces including file upload, PHP server, htadmin, and authentication management systems, potentially leading to full system compromise.","remediation":"Upgrade to Malcolm 2.590 or later to address the URL path normalization inconsistency in the RBAC authorization layer.","detection":"Monitor nginx access logs for requests with unusual path sequences (e.g., double slashes, encoded characters) that result in successful access to restricted administrative endpoints when the user's role should have denied access.","tags":["auth-bypass","web","rbac","nginx"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:20:14.163Z"}}