CVE-2026-85395 in UnoPim
Summary
by MITRE • 09/03/2026
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in UnoPim versions prior to 2.1.3 represents a critical failure in access control mechanisms within the application's administrative interface. Specifically, the system fails to register specific API endpoints related to integration stores, updates, and key generation into its Access Control List map. This omission creates a significant gap in the security architecture where these routes are effectively treated as public or unsecured by the middleware layer responsible for enforcing role-based permissions. Consequently, any user authenticated with an administrative account can access these sensitive operations without undergoing proper authorization checks, regardless of their assigned sub-roles or permission sets within the Bouncer middleware framework.
From a technical perspective, this flaw stems from incomplete route registration in the application's security configuration. The Bouncer middleware is designed to validate whether a logged-in user possesses specific permissions before allowing access to protected resources. However, because the integration store creation, update, and key-generation routes were not explicitly included in the ACL map, the middleware bypasses its validation logic for these endpoints. This allows an attacker with minimal admin privileges to interact directly with these API endpoints via HTTP requests, effectively circumventing the intended hierarchical permission structure that should restrict such actions to high-level administrators only.
The operational impact of this vulnerability is severe due to the nature of the affected functions. An adversary can exploit this misconfiguration to create new OAuth API integrations and mint client credentials without authorization. These generated credentials provide programmatic access to the application's data and functionality, potentially allowing for full system compromise if the attacker leverages them to perform further actions or exfiltrate sensitive information. This capability effectively elevates a low-privilege admin account to one with near-root capabilities within the context of API integrations, undermining the principle of least privilege that is central to secure application design.
This vulnerability aligns closely with CWE-284 Improper Access Control and CWE-862 Missing Authorization, as it involves a failure to enforce required permissions on specific resources. In terms of threat modeling, this behavior corresponds to MITRE ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials but exploits configuration flaws to gain unauthorized access or escalate privileges. The ability to generate OAuth tokens also relates to credential manipulation techniques that can facilitate persistent backdoor access if the generated keys are not properly monitored and rotated.
To mitigate this risk, administrators of UnoPim instances must upgrade immediately to version 2.1.3 or later, where these routes have been correctly integrated into the ACL map and protected by appropriate middleware checks. For organizations unable to patch instantly due to operational constraints, temporary mitigations should include restricting access to administrative endpoints through network-level controls such as firewall rules or reverse proxy configurations that block unauthorized HTTP methods on the affected paths. Additionally, implementing strict monitoring for OAuth client creation events can help detect potential exploitation attempts in real-time, allowing security teams to respond before significant damage occurs. Regular audits of role-based access control configurations are also recommended to ensure no other routes suffer from similar omissions in future updates.