Malcolm versions prior to 26.07.0 suffer from an incorrect authorization vulnerability (CWE-863) due to inconsistent URI normalization between Nginx routing and the Lua layer enforcing role-based access control. The Lua layer checks the raw, unnormalized request URI, while Nginx routes requests based on the normalized path. An attacker with low privileges can prepend traversal sequences (e.g., /x/../upload/...) to bypass authorization checks, gaining access to restricted backend endpoints. This vulnerability has a CVSS 3.1 score of 7.1 (high severity) with network attack vector, low attack complexity, and requires low privileges but no user interaction. The vulnerability is fixed in Malcolm version 26.07.0.

An authenticated user with low privileges can exploit this vulnerability to bypass role-based access controls and gain unauthorized access to restricted backend resources. This can lead to unauthorized data disclosure (high confidentiality impact) and limited integrity impact. There is no impact on availability. No known exploits are reported in the wild.

Upgrade Malcolm to version 26.07.0 or later, where this authorization bypass issue is fixed. Patch status is not explicitly stated but the vendor has released version 26.07.0 to address the vulnerability. No other mitigations are indicated.