CVE-2026-50759 in exo
Summary
by MITRE • 07/21/2026
An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability exists within the exo-explore exo 1.0.69 software framework where unauthorized remote attackers can exploit two specific API endpoints to achieve privilege escalation. The GET /state endpoint and DELETE /instance/{instance_id} endpoint lack proper authentication mechanisms, creating a critical security flaw that allows malicious actors to gain elevated system privileges without any authorization checks. This represents a fundamental failure in the application's access control implementation, where sensitive operations are exposed to unauthenticated users.
The technical nature of this vulnerability falls under CWE-284, which describes improper access control allowing unauthorized users to perform privileged actions. The flaw manifests as an absence of authentication requirements for critical system operations that should be restricted to authorized administrators or users with appropriate privileges. When attackers can issue DELETE requests against instance identifiers without proper credentials, they essentially gain the ability to manipulate or remove system resources, potentially leading to complete system compromise.
From an operational perspective, this vulnerability creates a severe risk landscape where remote attackers can execute arbitrary privilege escalation attacks against systems running this software version. The impact extends beyond simple data manipulation as the ability to delete instances suggests potential for service disruption, data loss, or even complete system degradation. The lack of authentication checks means that any network-connected attacker can leverage these endpoints to compromise system integrity and availability.
The attack surface is particularly concerning given that these are standard REST API endpoints commonly used for system management operations. Attackers could potentially use this vulnerability to delete critical system instances, disrupt services, or establish persistent access through compromised system resources. This aligns with ATT&CK technique T1068 which covers local privilege escalation and system manipulation through unauthenticated API access.
Recommended mitigations include implementing robust authentication mechanisms for all sensitive endpoints, including the addition of proper API key validation, session management, or OAuth2 authentication flows. The software should enforce strict access control lists that verify user credentials before allowing any privileged operations. Additionally, network segmentation and firewall rules should be implemented to restrict access to these endpoints to trusted administrative networks only. Regular security audits and penetration testing should be conducted to identify similar unauthenticated endpoints that may exist within the application framework.