Description

Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T14:17:10.240Z",
  "pubdate": "2026-08-13T14:17:10.240Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in Nokri versions <= 1.6.6. This security flaw allows unauthenticated malicious actors to bypass standard authorization mechanisms and access restricted functionalities or sensitive data intended for privileged users. The impact of this vulnerability includes unauthorized data exposure, potential system state manipulation, and compromise of application integrity. Affected systems comprise all installations of the Nokri product running version 1.6.6 or lower. The risk implications are severe, as exploitation requires no prior authentication or specialized privileges, lowering the barrier to entry for external attackers. Attackers can leverage network connectivity to exploit the application directly without interacting with legitimate users. Remediation requires immediate attention through vendor-supplied patches or restrictive access controls.",
  "technicalDetails": "The vulnerability resides in the access control implementation of Nokri versions <= 1.6.6, where sensitive endpoints or functions fail to adequately validate the authorization status and privilege levels of incoming requests. Specifically, the root cause stems from missing or inadequate access control checks within the request handling logic, allowing unauthenticated clients to invoke privileged functions directly. Attackers can exploit this flaw by crafting malicious HTTP requests directed at exposed backend components or function handlers that lack session validation or role verification. The attack flow begins with the attacker identifying vulnerable routes or parameters exposed over the network. By transmitting tailored payloads directly to these endpoints, the attacker bypasses the intended security boundaries of the application. Because the affected component does not enforce authentication requirements, the server processes the request as if it originated from a legitimate, authorized user. Network exposure is broad, as the application is typically accessible via standard HTTP/HTTPS protocols over the internet. Privilege requirements are nonexistent, enabling unauthenticated remote exploitation. Post-exploitation impact varies depending on the specific functionality exposed through the broken access control vector, potentially leading to unauthorized data retrieval, administrative action execution, or broader system compromise within the application environment."
}