Threats tagged 'ghsa-pvvm-cxq7-hrgr'

CVE-2026-58080 affects Eclipse Milo versions 1.0.0 through 1.1.4. The vulnerability arises because the OpcUaServerConfig.copy() method does not preserve a configured RoleMapper. This causes sessions to receive no role IDs, leading the default access controller to skip role-permission checks. As a result, anonymous clients can read role-permission metadata, invoke protected methods, or delete protected nodes where anonymous sessions are allowed.