CVE-2026-92801: cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cc-connectto a version that resolves this vulnerability.Fixed in 1.5.0
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Deployments using cc-connect's Feishu integration are exposed when an attacker can trigger interactive card actions in a chat that has been admitted. The affected access control is the per-user allowlist; the issue does not indicate that access to arbitrary, non-admitted chats is gained.
What does an attacker need to exploit it?
An attacker needs the ability to trigger a Feishu interactive card callback in an admitted chat. No user interaction is required, and the listed attack vector is network-based with low attack complexity, but the attacker must have the low privileges needed to invoke the card action.
Are text-message commands also affected?
The issue specifically affects the onCardAction handler for Feishu interactive card callbacks. The description states that the text-message handler is protected by per-user access controls, so the documented bypass is limited to card actions.
How can I determine whether my deployment is affected?
Check whether you run cc-connect version 1.5.0 or earlier and use Feishu interactive cards in admitted chats. Affected behavior would allow a user who is not on the per-user allowlist to dispatch agent commands through a card action.