Apache APISIX versions 0.9 through 3.19.0 contain an interpretation conflict vulnerability that allows unauthenticated clients to access upstream paths protected by route-level authentication plugins if a route without authentication exists on the same upstream and the upstream does not collapse encoded dot segments. This incorrect authorization issue is fixed in version 3.20.0.