The vulnerability in cc-connect versions up to 1.5.0 arises from a failure to enforce per-user allowlist filtering in the onCardAction handler, which processes Feishu interactive card callbacks. As a result, attackers can trigger card actions within chats they have access to and dispatch agent commands, circumventing the per-user access restrictions designed to protect the text message handler. This improper authorization flaw leads to a high-impact security risk, as indicated by the CVSS 4.0 score of 8.7.

Attackers with limited privileges can bypass per-user access controls and dispatch agent commands by exploiting the flawed onCardAction handler. This could lead to unauthorized command execution within the application context, potentially compromising system integrity and confidentiality. The vulnerability does not require user interaction and has a low attack complexity, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to admitted chats and monitor for suspicious card action triggers. Avoid deploying cc-connect versions up to and including 1.5.0 in sensitive environments.