In Eclipse Milo versions 1.0.0 through 1.1.4, the method OpcUaServerConfig.copy() fails to preserve the configured RoleMapper. Servers that rely on role permissions and build their running configuration via this copy method end up with sessions that have no role IDs assigned. Consequently, the default access controller bypasses role-permission checks, allowing anonymous clients (in contexts where anonymous sessions are permitted) to access role-permission metadata, invoke protected methods, or delete protected nodes. This represents an authorization bypass vulnerability classified as CWE-862.

The vulnerability allows unauthorized anonymous clients to bypass role-based access controls. They can read sensitive role-permission metadata, invoke methods that should be protected, and delete protected nodes. This can lead to unauthorized data disclosure, unauthorized actions, and potential disruption of the server's operation. The CVSS 4.0 base score is 8.8 (high severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on integrity and low impact on confidentiality.

No official fix or patch is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should avoid relying on the OpcUaServerConfig.copy() method for constructing running configurations that enforce role permissions or implement additional access control measures to compensate for this issue.