{"id":"CVE-2026-48599","title":"Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the qu…","summary":"Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the qu…","severity":"high","cvss":7.6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-639"],"vendor":"elixir-grpc","product":"grpc","affected":["grpc >= 0.8.0 < 1.0.0","elixir-grpc/grpc >= 8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 < 33b6a095dbc91c6dee3c7b90893d7d74952e82e4"],"patched":["grpc 1.0.0"],"published":"2026-06-15","updated":"2026-09-24","sourceUpdated":"2026-09-24T21:17:13.967","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48599","references":[{"url":"https://cna.erlef.org/cves/CVE-2026-48599.html","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-48599","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48599"},{"url":"https://github.com/elixir-grpc/grpc/pull/541"},{"url":"https://github.com/elixir-grpc/grpc/releases/tag/v1.0.0"},{"url":"https://github.com/advisories/GHSA-mwr4-5g34-j5cq"}],"tags":["nvd","cve.org","exploit-available","ghsa","erlang"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-06-16T14:45:46.288762Z"},"cvssSource":"cna","epss":0.00339,"epssPercentile":0.27216,"aliases":["GHSA-mwr4-5g34-j5cq"],"ecosystem":"erlang","ingestedAt":"2026-08-25T18:30:21.273Z","slug":"CVE-2026-48599","body":"## Overview\n\nAuthorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn 'Elixir.GRPC.Server.Transcode':map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {\"user_id\": \"victim\"} when body: \"*\") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-48599)\n\nAffected packages:\n\n- `grpc >= 0.8.0, < 1.0.0`\n\nPatched in:\n\n- `grpc 1.0.0`\n\nSource: https://github.com/advisories/GHSA-mwr4-5g34-j5cq","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":210399,"id":"CVE-2026-48599","ts":1790286814982,"field":"exploit_available","old":"false","new":"true"},{"seq":210398,"id":"CVE-2026-48599","ts":1790286814982,"field":"cvss","old":null,"new":"7.6"}]}