CVE-2026-82815: Improper Access Controls in MegaEase EaseProbe

This vulnerability affects the realIP function in the Middleware component of MegaEase EaseProbe versions 2.0 through 2.3.0. The flaw arises from improper handling of the X-Forwarded-For, X-Real-IP, and True-Client-IP HTTP headers, allowing an attacker to manipulate these headers to bypass access controls. The attack vector is remote and does not require privileges or user interaction. Although an exploit has been published, the vendor has not responded or provided a fix as of the publication date.

Successful exploitation can lead to bypassing access controls, potentially allowing unauthorized access to protected resources or functionality within EaseProbe. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no required privileges or user interaction, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing network-level protections such as filtering or validating incoming HTTP headers to mitigate risk until an official patch is released.