Lupa versions 2.6 and earlier contain an improper access control vulnerability (CWE-284) due to inconsistent enforcement of attribute_filter when attributes are accessed through built-in functions such as getattr and setattr. This flaw enables attackers to circumvent attribute restrictions and ultimately execute arbitrary code within the affected environment. The vulnerability has a CVSS 4.0 base score of 7.9, indicating high severity. There is no explicit vendor patch or remediation level stated in the advisory. Red Hat advisories reference this CVE but do not provide a direct fix or mitigation, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass attribute access restrictions in Lupa and achieve arbitrary code execution. This can compromise the security of applications embedding Lua or LuaJIT2 via Lupa, potentially leading to full system compromise depending on the execution context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisories referencing this CVE do not specify an available fix or mitigation. Users should monitor official vendor channels for updates and consider restricting access to affected Lupa versions or applying application-level controls to limit exposure until a patch is released.