In Eclipse Milo versions 1.0.0 through 1.1.4, the method OpcUaServerConfig.copy() fails to copy the configured RoleMapper. Servers that rely on role-based permissions and build their running configuration via this copy method end up with sessions that lack role IDs. Consequently, the default access controller bypasses role-permission checks, enabling anonymous clients (when anonymous sessions are permitted) to access role-permission metadata, invoke protected methods, or delete protected nodes. This is identified as CWE-862 (Missing Authorization).

The vulnerability allows unauthorized anonymous clients to bypass role-based access controls on affected Eclipse Milo servers. This can lead to unauthorized reading of role-permission metadata, invocation of protected methods, and deletion of protected nodes. The CVSS 4.0 base score is 8.8 (high severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on integrity and low impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users should monitor the Eclipse Foundation's advisories for updates and consider restricting anonymous session permissions as a temporary measure.