CVE-2026-92992 is an authorization bypass vulnerability in Dromara mayfly-go affecting versions up to 1.11.5. The vulnerability resides in an unspecified function in the AI Assistant component's ai.go file. It allows remote attackers to bypass authorization controls due to a whitelist bypass that is one-token wide, enabling compound commands containing curl, wget, or sed to execute automatically with the session user's approval implicitly granted. A silent patch addressing this issue has been applied, identified by commit 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde.

The vulnerability can lead to unauthorized remote command execution with low privileges, potentially resulting in limited confidentiality, integrity, and availability impacts. The CVSS score of 6.3 reflects a moderate severity with network attack vector, low attack complexity, and no user interaction required. The exploit has been publicly disclosed but there are no known exploits in the wild at this time.

A patch has been applied to fix this vulnerability as indicated by the silent patch commit 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde. Users should apply this patch to remediate the issue. Since the patch is available, no additional mitigation steps are required beyond updating to the fixed version.