CVE-2026-85395
UnoPim before 2.1.3 Missing Authorization on Integration Management Routes
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 3, 2026
- Updated
- Sep 5, 2026
- Reserved
- Sep 3, 2026
Description
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
unopimunopim |
|
References
- Patch Commitpatch
- https://github.com/unopim/unopimproduct
- UnoPim v2.1.3 Release Notesrelease-notes
- https://github.com/unopim/unopim/blob/v2.1.2/packages/Webkul/User/src/Http/Middleware/Bouncer.phptechnical-description
- https://github.com/geo-chen/oss/blob/main/unopim.mdtechnical-description
- VulnCheck Advisory: UnoPim before 2.1.3 Missing Authorization on Integration Management Routesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.