This vulnerability arises from missing authorization checks in CISA Malcolm's deployment mode designed for read-only access. The system denies write-capable routes by pattern matching, but the pattern omits routes that modify tags on stored session records. Because the proxy configuration permits the HTTP methods used by these routes, an authenticated user can modify tags on session records even when the deployment is intended to be read-only. The CVSS 4.0 base score is 5.3, indicating medium severity. No known exploits or patches are currently reported.

An authenticated user on a deployment configured for read-only access can add or remove tags on stored session records. This could lead to unauthorized modification of metadata associated with session data, potentially impacting data integrity or operational processes relying on tag information. There is no indication of privilege escalation beyond the authenticated user level or direct compromise of session data content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted authenticated users only and monitor for unauthorized tag modifications. Review and adjust proxy configurations and route pattern matching to ensure all write-capable routes are properly denied in read-only deployments.