Pexip Infinity versions prior to 38.2, as well as 39.0, 39.1, and 40.0, contain an incorrect authorization vulnerability (CWE-863) in a product-internal API. This flaw permits an attacker who has local access to a node in the Pexip Infinity deployment to execute arbitrary code on a different node as an unprivileged user. The CVSS 3.1 base score is 8.8, indicating high severity, with attack vector being adjacent network (AV:A), low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with local access to a node in the Pexip Infinity environment can leverage this vulnerability to execute arbitrary code on another node as an unprivileged user. This can lead to significant compromise of system confidentiality, integrity, and availability within the affected installation.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to Pexip Infinity nodes to trusted personnel only and monitor for suspicious activity.