The vulnerability in elixir-grpc grpc (versions >=0.8.0 <1.0.0) arises in the 'Elixir.GRPC.Server.Transcode':map_request/5 function where path-bound fields are merged with user-supplied data using Map.merge/2 with the path bindings as the first argument. This merge order causes attacker-controlled values in query strings or request bodies to overwrite path-bound fields that are typically used for authorization, multi-tenancy scoping, or ownership verification. Consequently, an authenticated attacker can bypass authorization controls by smuggling conflicting values, gaining unauthorized access or modification rights to other users' resources.

Authenticated attackers can bypass authorization checks that rely on path-bound fields, potentially accessing or modifying resources belonging to other users. This undermines the integrity of authorization mechanisms and can lead to unauthorized data exposure or manipulation. The vulnerability affects grpc versions from 0.8.0 up to but not including 1.0.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, review and modify any authorization logic that depends on path-bound fields to ensure they cannot be overridden by user-controlled input. Avoid relying solely on merged request data for authorization decisions.