CVE-2026-90448: Missing Authorization in Malcolm
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials. This allows an authenticated user on a deployment intended to be read-only to forge or overwrite stored records that should not be modifiable in that deployment mode.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user of a deployment configured or intended to provide read-only access can exploit it. The issue affects the proxied API route that does not restrict request methods.
What level of data modification is possible?
An attacker can create a stored record or overwrite an existing one. They can supply the record identifier, allowing them to target attacker-chosen records.
Does exploitation require direct access to elevated backend credentials?
No. The vulnerable route performs the write operation using the application's own elevated backend credentials.