{"id":"CVE-2026-118681","title":"go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware","summary":"go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer rou…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-288"],"vendor":"go-chi","product":"chi","affected":["chi < 5.5.0"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T18:59:52.523Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118681","references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958","label":"GitHub Security Advisory (GHSA-rqrp-8cg2-5958)"},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-before-5.5.0-authentication-bypass-via-supressnotfound-middleware","label":"VulnCheck Advisory: go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware"}],"tags":["cve.org"],"epss":0.00244,"epssPercentile":0.15591,"ingestedAt":"2026-10-29T15:37:07.547Z","slug":"CVE-2026-118681","body":"## Overview\n\ngo-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.\n\n## Affected\n\n- `chi < 5.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}