Description

A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-11T20:18:45.410Z",
  "pubdate": "2026-08-11T20:18:45.410Z",
  "executiveSummary": "A critical authorization flaw exists in acm-search-v2-api-rhel9, specifically within the caching mechanism of the getFederationConfig function. The vulnerability involves improper token management where an authenticated user's bearer token is improperly reused across cache refresh cycles for all subsequent federated requests until the cache expiration time is reached.\nThe primary impact of this vulnerability is unauthorized information disclosure. An authenticated attacker or subsequent users interacting with the system can inherit the previously cached bearer token privileges, granting them unauthorized access to sensitive remote managed hub search results that they should otherwise not be permitted to view.\nThe affected system is acm-search-v2-api-rhel9. The risk implications are severe for multi-tenant or shared enterprise environments where data isolation between distinct authenticated users is critical. Exploitation requires the attacker to have valid authentication capabilities to initiate requests, triggering or coinciding with the cache refresh window managed by the getFederationConfig function, thereby hijacking or improperly inheriting the cached security context.",
  "technicalDetails": "The vulnerability resides in the acm-search-v2-api-rhel9 product, specifically within the getFederationConfig function responsible for handling federation configuration caching. The root cause of the vulnerability is an improper state management implementation during the cache refresh lifecycle. Instead of isolating security contexts per user session or properly invalidating and requesting tokens scoped to individual execution contexts, the application improperly binds and reuses a single user's bearer token globally for all subsequent federated requests.\nFrom an attack flow perspective, exploitation occurs through the following step-by-step mechanism: 1. An authenticated user initiates a request that triggers the getFederationConfig function to refresh its internal cache. 2. During this cache refresh operation, the system captures the user's bearer token and stores it alongside the federation configuration data. 3. Subsequent federated requests made by other distinct authenticated users erroneously retrieve and utilize this stored bearer token instead of evaluating the current requester's valid security credentials or session context. 4. The remote managed hub processes these requests using the cached, hijacked bearer token, bypassing intended access controls and authorization checks. 5. Consequently, unauthorized users gain access to sensitive search results and metadata originating from the remote managed hubs.\nThe vulnerable component is the token caching and retrieval logic inside the getFederationConfig function. The vulnerability requires the attacker to be authenticated to the system, but demands no elevated privileges beyond standard user access, provided they can interact with the API during or after the cache refresh state is populated with another user's token. The exposure is network-based via the API endpoints governed by the affected application. Post-exploitation impact is strictly centered around unauthorized information disclosure, allowing cross-user data exposure and breach of data confidentiality regarding remote managed hub search results."
}