Malcolm's nginx Lua RBAC layer performs access control checks on the raw, percent-encoded request URI, while nginx itself routes requests based on the percent-decoded, normalized URI. Because the RBAC check does not decode the URI before matching, an attacker with low privileges can craft requests with percent-encoded characters representing restricted paths (e.g., /%68tadmin.php instead of /htadmin.php). Nginx routes these requests to restricted locations, but the RBAC layer fails to recognize them as restricted, resulting in unauthorized access to admin-only endpoints.

An authenticated user with low privileges can bypass role-based access controls and gain unauthorized access to admin-only paths and endpoints. This could lead to unauthorized actions or data exposure within the Malcolm system. The vulnerability does not allow privilege escalation from unauthenticated users and requires authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider additional access control measures outside of the vulnerable RBAC layer or restrict access at the network level to sensitive endpoints. Monitoring for unusual access patterns involving percent-encoded URIs may help detect exploitation attempts.