CVE-2026-85395: UnoPim before 2.1.3 Missing Authorization on Integration Management Routes
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UnoPimto a version that resolves this vulnerability.Fixed in 2.1.3 - Configuration
Update Bouncer middleware ACL map so integration store, integration update, and key-generation routes are covered to enforce authorization validation (so admin users cannot bypass permission checks).
UnoPim Bouncer middleware (ACL map) ACL map entries for integration store/update/key-generation routes = Include integration store, update, and key-generation routes
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated UnoPim admin user with minimal administrative privileges can exploit it. The attack does not require user interaction and can be performed remotely through the affected routes.
Which functions are exposed to unauthorized access?
The affected integration management functions include creating integrations, updating integrations, and generating integration keys. Missing ACL entries allow these routes to bypass the intended permission checks.
What could an attacker gain by exploiting the issue?
An attacker can create OAuth API integrations and mint client credentials. This can be used to escalate permissions beyond those granted to the attacker’s existing admin account.
Are installations running version 2.1.3 affected?
The issue affects UnoPim versions before 2.1.3. The provided release reference identifies v2.1.3 as the version containing the relevant fix.