CVE-2026-92801 in cc-connect
Summary
by MITRE • 09/16/2026
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in cc-connect versions through 1.5.0 represents a critical authorization failure within the Feishu interactive card callback processing logic. Specifically, the onCardAction handler responsible for managing user interactions with dynamic cards fails to enforce per-user allowlist filtering mechanisms that are otherwise present and functional in other parts of the application architecture. This inconsistency creates a significant security gap where access control policies defined at the text message handling level are not applied uniformly across all input vectors provided by the Feishu platform interface. The core technical flaw lies in the absence of identity verification or permission checks when processing card action payloads, allowing any authenticated user within an admitted chat to execute backend operations without proper authorization validation.
From a technical perspective, this issue classifies as Broken Access Control under the Common Weakness Enumeration (CWE) framework, specifically aligning with CWE-285 Improper Authorization and potentially CWE-639 Injection via Insecure Direct Object References if specific internal identifiers are manipulated. The attacker exploits this weakness by crafting malicious card action payloads that trigger agent commands on the backend server. Because the system processes these actions without verifying whether the initiating user is permitted to execute such commands, it effectively bypasses the intended security boundaries. This behavior mirrors techniques documented in the MITRE ATT&CK framework under T1078 Valid Accounts and potentially T1190 Exploit Public-Facing Application, as the vulnerability allows an adversary to leverage legitimate application features for unauthorized command execution within a trusted environment.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and arbitrary code execution via agent commands. An attacker who gains access to any chat where interactive cards are enabled can dispatch commands that interact with backend systems, potentially leading to data exfiltration, system compromise, or lateral movement within the network infrastructure dependent on cc-connect services. Since Feishu is a widely used enterprise collaboration platform, this vulnerability could be exploited in social engineering scenarios where attackers trick users into interacting with malicious cards embedded in legitimate-looking conversations. The lack of per-user filtering means that even if an organization has strict allowlists for text-based inputs, those protections are rendered ineffective against card-based interactions, creating a blind spot in the security posture.
Mitigation strategies must focus on immediate patching and architectural review. Organizations running cc-connect versions prior to 1.5.0 should upgrade to the latest stable release where this authorization logic has been corrected to ensure consistent enforcement of allowlists across all handler types. In environments where upgrading is not immediately feasible, administrators can implement network-level controls such as web application firewalls (WAF) rules that inspect Feishu callback payloads for known malicious patterns or unexpected command structures. Additionally, implementing strict input validation and ensuring that the onCardAction handler mirrors the security checks of the text message handler will restore defense-in-depth principles. Regular audits of third-party integrations and continuous monitoring of access logs for anomalous card action events are recommended to detect potential exploitation attempts in real-time.