Catalyst::Seal versions prior to 0.03 implement a dispatch memo keyed solely on the request path, omitting other request attributes such as HTTP method, content type, scheme, or query parameters. This incomplete comparison leads to memoized dispatch resolutions that do not accurately reflect the current request's context. For example, a GET request to a POST-only path memoizes a no-action result, disabling that path for subsequent requests including legitimate POSTs. Similarly, a GET request may memoize a shallower route, causing a later POST request to be dispatched incorrectly to a less privileged action guarded by an auto() method, preventing the intended deeper controller from running. The memo cache is cleared only when actions are registered at setup, so entries persist for the process lifetime, with a maximum of 2048 entries. This results in authorization checks being skipped rather than privilege escalation, due to requests being routed to less privileged actions.

The vulnerability allows certain requests to disable or misroute subsequent requests by exploiting the dispatch memoization keyed only on the request path. This causes authorization checks to be bypassed because requests are handled by less privileged actions or no action at all. The impact is an authorization bypass rather than privilege escalation. The memo cache persists for the life of the process, affecting multiple requests and potentially multiple users until the process restarts or actions are re-registered.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding Catalyst::Seal versions before 0.03 or implement additional request validation and authorization checks outside of the dispatch memoization mechanism. Restarting the application process clears the memo cache but does not prevent the issue from recurring. Monitor vendor channels for an official patch or update.