CVE-2026-54568: CWE-639: Authorization Bypass Through User-Controlled Key in microsoft UFO
Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.
AI Analysis
Technical Summary
In Microsoft UFO open-source framework versions from 3.0.0 up to but not including 3.0.6, a client connected as a DEVICE to the UFO WebSocket server could invoke the DEVICE_INFO_REQUEST with a target_id of another device and receive that device's server-side system_info. This is due to the handle_device_info_request and get_device_info functions in ufo/server/ws/handler.py not enforcing the constellation-only role or object-level authorization boundaries, leading to an authorization bypass vulnerability (CWE-639, CWE-862). The vulnerability allows unauthorized disclosure of system information but does not affect integrity or availability. The issue is resolved in version 3.0.6.
Potential Impact
An attacker with device-level privileges can obtain system information of other devices connected to the UFO WebSocket server without proper authorization. The confidentiality of system_info is compromised, but there is no impact on integrity or availability. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low complexity and network attack vector but requiring some privileges.
Mitigation Recommendations
Upgrade Microsoft UFO to version 3.0.6 or later, where this authorization bypass vulnerability is fixed. Since the vendor advisory confirms the fix in 3.0.6, applying this update fully mitigates the issue. No additional mitigations are specified or required.
CVE-2026-54568: CWE-639: Authorization Bypass Through User-Controlled Key in microsoft UFO
Description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Microsoft UFO open-source framework versions from 3.0.0 up to but not including 3.0.6, a client connected as a DEVICE to the UFO WebSocket server could invoke the DEVICE_INFO_REQUEST with a target_id of another device and receive that device's server-side system_info. This is due to the handle_device_info_request and get_device_info functions in ufo/server/ws/handler.py not enforcing the constellation-only role or object-level authorization boundaries, leading to an authorization bypass vulnerability (CWE-639, CWE-862). The vulnerability allows unauthorized disclosure of system information but does not affect integrity or availability. The issue is resolved in version 3.0.6.
Potential Impact
An attacker with device-level privileges can obtain system information of other devices connected to the UFO WebSocket server without proper authorization. The confidentiality of system_info is compromised, but there is no impact on integrity or availability. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low complexity and network attack vector but requiring some privileges.
Mitigation Recommendations
Upgrade Microsoft UFO to version 3.0.6 or later, where this authorization bypass vulnerability is fixed. Since the vendor advisory confirms the fix in 3.0.6, applying this update fully mitigates the issue. No additional mitigations are specified or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T19:15:27.343Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a59044668715ace4352ade8
Added to database: 07/16/2026, 16:18:14 UTC
Last enriched: 07/16/2026, 16:33:20 UTC
Last updated: 07/17/2026, 03:05:16 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.