This vulnerability in Peplink InControl versions 2 through 2.14.2 before 2026-06-03 arises from improper ordering of authorization checks before parsing and canonicalization of input. Specifically, the use of a semicolon in requests to certain /rest/o/{orgId} endpoints can bypass access-control rules. This is categorized as CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization). The CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, requiring low privilege, no user interaction, scope change, and high confidentiality impact.

Successful exploitation allows an attacker with low privileges to bypass access controls on specific REST API endpoints, potentially exposing sensitive organizational data (confidentiality impact). There is no impact on integrity or availability. The vulnerability affects confidentiality with a scope change, meaning the attacker can access resources beyond their authorization level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Until a patch is available, restrict access to the affected endpoints and monitor for suspicious use of semicolons in request URLs as a potential indicator of exploitation attempts.