UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass… (CVE-2026-85395)

UnoPim before version 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, which leads to a bypass of permission checks for admin users. Attackers with limited admin privileges can exploit this by creating OAuth API integrations and minting client credentials, effectively escalating their permissions. The root cause is missing authorization validation in the Bouncer middleware, classified under CWE-862 (Missing Authorization). The CVSS 3.1 score is 7.1, indicating a high severity vulnerability with network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, limited confidentiality impact, high integrity impact, and no availability impact.

An attacker with minimal admin privileges can bypass intended permission checks to create OAuth API integrations and mint client credentials, leading to unauthorized permission escalation. This could compromise the integrity of the system by allowing unauthorized actions that should be restricted, though availability is not affected and confidentiality impact is limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict admin privileges to trusted users only and review OAuth API integration activities closely to detect potential misuse.