In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service improperly handles authorization for mixed batches of method calls. After calculating authorization on the batch, it dispatches the original mixed batch to address-space handlers, which allows an anonymous or low-privileged client to execute a method that should be denied by including it alongside an allowed method in the same batch. This is a CWE-863 (Incorrect Authorization) vulnerability with a CVSS 4.0 score of 8.7, indicating high severity. No official remediation or patch is currently documented in the provided data.

An attacker with no or low privileges can execute methods that should be denied by batching them with allowed methods. This bypasses intended authorization controls, potentially leading to unauthorized actions within the affected Eclipse Milo service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected service to trusted clients only and monitor for suspicious batch requests that mix allowed and denied methods.