The vulnerability arises because Malcolm's role-authorization mechanism defaults to allow access when a request handler's name is missing from the role requirements table, instead of denying access. Consequently, any request handler not explicitly registered is accessible to all authenticated users regardless of their assigned roles. This fail-open behavior also applies to newly added handlers until they are explicitly added to the authorization table. The affected versions are >=0 and <26.06.0. No patch or remediation details are provided in the input data.

Any authenticated user can access request handlers that are not explicitly registered in the role-authorization table, potentially leading to unauthorized access to functionality or data. This could allow privilege escalation or unauthorized operations within the Malcolm application. The impact is limited to authenticated users but bypasses intended role restrictions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should audit the role-authorization table to ensure all request handlers are explicitly registered with appropriate role requirements. Newly added handlers should be carefully reviewed and added to the authorization table to avoid fail-open access.