FlexRIC v2.0.0 contains an authorization bypass vulnerability in the iApp's xApp isolation mechanism due to a faulty equality check in eq_xapp_ric_gen_id() within src/ric/iApp/xapp_ric_id.c. The function compares m0->xapp_id against itself instead of m1->xapp_id, effectively ignoring the xApp identity dimension. As a result, a malicious xApp connected on port 36422 can send an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id to delete subscriptions of other xApps. This compromises multi-tenant isolation in environments where multiple xApps share the same RIC.

The vulnerability allows a malicious xApp to bypass authorization controls and delete subscriptions belonging to other xApps. This breaks multi-tenant isolation, potentially disrupting services or operations of other tenants sharing the same RIC instance. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the iApp port (36422) to trusted xApps only and monitor for unusual subscription deletion requests. Avoid deploying multiple untrusted xApps on the same RIC instance to reduce risk.