CVE-2026-107334: CWE-863 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua RBAC layer performs access control checks on the raw, percent-encoded request URI, but nginx routes requests using the percent-decoded URI. Because the RBAC check does not decode the URI before matching, an authenticated user with low privileges can craft requests with percent-encoded characters (e.g., /%68tadmin.php) that nginx routes to restricted admin locations, while the RBAC check fails to recognize the restricted path and grants access improperly. This is an incorrect authorization vulnerability classified as CWE-863.

An authenticated user with low privileges can bypass role-based access controls to access admin-only endpoints by exploiting the mismatch between the RBAC check on the raw URI and nginx's routing on the decoded URI. This can lead to unauthorized access to sensitive administrative functions, resulting in limited confidentiality and integrity impact. There is no indication of availability impact or known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to administrative endpoints through other means such as network-level controls or additional authentication layers. Avoid relying solely on the current RBAC implementation for critical access control.