The Feast Feature Server contains a missing authorization vulnerability in its /save-document endpoint. An unauthenticated attacker with network access can bypass file location restrictions and write arbitrary JSON files to the server's filesystem. This can result in overwriting critical application configuration files or startup scripts. The vulnerability requires no authentication or privileges, making it highly accessible to attackers. The impact includes integrity compromise, denial of service, and possible remote code execution. The CVSS 3.1 base score is 9.1 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. No official patch or remediation level is currently stated in the vendor advisory. The vendor advisory from Red Hat is available but does not specify a fix or mitigation status.

An attacker can write arbitrary JSON files without authentication, potentially overwriting vital application configurations or startup scripts. This can compromise system integrity, cause denial of service through disk exhaustion, or enable remote code execution. The vulnerability affects the availability and integrity of the affected system but does not directly impact confidentiality according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-23537 for current remediation guidance. Until a fix is available, restrict network access to the Feast Feature Server to trusted users only and monitor for unusual file changes. Do not expose the /save-document endpoint to untrusted networks. Follow vendor updates closely for official patches or mitigations.