CVE-2026-92801 in cc-connect
要約
〜によって MITRE • 2026年09月16日
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.