CVE-2026-111691

7.4High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.4High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-290

Impact

Attackers can bypass authentication to impersonate any tenant and hijack admin privileges, letting them read or alter orders, financial data, and Amazon seller accounts. Exploitation requires network access to the backend service ports directly, bypassing the API gateway.

Root cause

The UserInfoFilter blindly trusts unsigned user identity claims passed directly inside the incoming X-USERINFO HTTP header.

Affected systems

WIMOOR through commit ec86736

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

No patched version or commit is listed yet. Block direct external access to internal backend service ports via network firewall or security groups, ensuring only the API gateway can reach them and strip or overwrite inbound X-USERINFO headers.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111691