The vulnerability exists in the Elixir.GRPC.Server.Transcode module's map_request/5 function, where Map.merge/2 is used with path bindings as the first argument, giving them lower precedence. This allows an attacker to supply a conflicting value for any path-bound field through the query string or request body, which then overrides the router-extracted value in the decoded protobuf struct. Consequently, any authorization, multi-tenancy, or ownership checks based on these path-bound fields can be bypassed, enabling unauthorized access or modification of other users' resources. This affects grpc versions from 0.8.0 up to but not including 1.0.0.

Authenticated attackers can bypass authorization controls by manipulating path-bound fields, potentially accessing or modifying resources belonging to other users. This compromises the integrity and confidentiality of user data in affected grpc services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, avoid relying solely on path-bound fields for authorization decisions or implement additional validation to ensure these fields cannot be overridden by user-controlled input.