Read the docs
TI-2026-69636 Aliases CVE-2026-107333GHSA-x76r-x5vc-mv69

Incorrect authorization in Malcolm lets users reach restricted paths

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Malcolm's nginx based reverse proxy has a URL path normalization inconsistency between its Lua based role-based access control (RBAC) layer and nginx's request routing. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints. This affects all restricted paths protected by the RBAC layer, including file upload, PHP server, htadmin, and authentication management interfaces. The weakness is classified as CWE-863.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0123 69th percentileScored 2026-11-07
Fix Fixed Malcolm (CISA): 26.08.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CISAMalcolmup to 26.07.126.08.0Patch availableCNA
  • Malcolm VendorCISA Affected up to 26.07.1 Fixed in 26.08.0 Patch available CNA

Remediation

Malcolm is fixed in version 26.08.0, so upgrade to that version or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Malcolm (CISA) Fixed in 26.08.0

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107333
  2. 2026-10-09 Alias added: GHSA-x76r-x5vc-mv69
  3. 2026-10-09 CISA SSVC decision points changed
  4. 2026-10-09 Priority changed: MEDIUM → LOW
  5. 2026-10-31 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2026-69642 Server-side request forgery in Malcolm file upload component CVSS 3.1HIGH 7.1
  • TI-2026-69640 Cross-Site Request Forgery in Malcolm CVSS 3.1HIGH 7.1
  • TI-2026-69638 Compressed file uploads in Malcolm can exhaust shared disk space CVSS 3.1MEDIUM 6.5
  • TI-2026-69637 Incorrect authorization in Malcolm exposes role-restricted paths CVSS 3.1MEDIUM 5.4
  • TI-2025-24590 CISA Thorium download stream divide by zero CVSS 4.0MEDIUM 5.3
  • TI-2025-24585 CISA Thorium insecure downloaded file path validation CVSS 4.0MEDIUM 5.3
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences