In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service performs authorization checks on a batch of method calls but dispatches the original mixed batch to address-space handlers afterward. This flaw allows an attacker with no or low privileges to execute methods that should be denied by including them in a batch with allowed methods. This is an instance of CWE-863: Incorrect Authorization. The vulnerability has a CVSS 4.0 score of 8.7 (high severity), indicating network attack vector, no privileges required, no user interaction, and high impact on integrity.

An attacker who can send method call batches to the Call service can bypass authorization controls and execute methods they are not permitted to invoke. This could lead to unauthorized actions within the affected Eclipse Milo service, potentially compromising system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor Eclipse Foundation advisories for updates and apply patches once available.