High severity7.1NVD Advisory· Published Sep 3, 2026
CVE-2026-85395
CVE-2026-85395
Description
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/geo-chen/oss/blob/main/unopim.mdnvd
- github.com/unopim/unopim/blob/v2.1.2/packages/Webkul/User/src/Http/Middleware/Bouncer.phpnvd
- github.com/unopim/unopim/commit/acbf2e160ced78446d6e4267e89f264bf04612c4nvd
- github.com/unopim/unopim/releases/tag/v2.1.3nvd
- www.vulncheck.com/advisories/unopim-before-2.1.3-missing-authorization-on-integration-management-routesnvd
News mentions
0No linked articles in our index yet.