bunkerweb, an open-source Web Application Firewall, had an improper authorization vulnerability (CWE-285) in versions >=1.6.2 <1.6.12. The BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, causing routes such as POST /cache/delete to be protected only by @login_required. This allowed low-privilege read-only reader accounts to delete job cache files containing important configuration data like blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom data. The vulnerability was addressed and fixed in version 1.6.12.

The vulnerability allows low-privilege read-only users to permanently delete critical cache files related to security configurations and threat intelligence data. This can degrade the effectiveness of the WAF by removing blacklist and other protective data, potentially increasing exposure to attacks. There is no direct confidentiality impact, but integrity and availability of security data are affected.

Upgrade bunkerweb to version 1.6.12 or later, where this authorization bypass issue has been fixed. No other mitigation is indicated by the vendor advisory.