Description

Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T12:16:37.690Z",
  "pubdate": "2026-08-20T12:16:37.690Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in Koji versions <= 2.2.1. This security flaw allows unauthenticated remote attackers to bypass authorization mechanisms and access restricted functionalities or resources that should otherwise be protected.\nThe vulnerability directly impacts the integrity and confidentiality of deployments running vulnerable instances of Koji. By leveraging this broken access control flaw, threat actors with network access can execute unauthorized operations without requiring prior authentication or valid session credentials.\nThe risk implications are severe, potentially leading to unauthorized data exposure, system manipulation, or administrative compromise depending on the specific endpoints exposed through the flawed access controls.\nExploitation requirements are minimal, as the lack of authentication mechanisms allows trivial interaction with vulnerable components over the network. Remediation requires updating Koji beyond version 2.2.1 or applying appropriate access control patches provided by the vendor.",
  "technicalDetails": "The vulnerability resides in the access control implementation of Koji versions <= 2.2.1, where critical endpoints fail to properly validate user sessions, roles, or permissions prior to processing incoming requests.\nThe root cause stems from missing authorization checks or improperly configured route protection within the application logic, allowing arbitrary clients to interact with sensitive functions directly.\nThe attack flow begins when an unauthenticated attacker crafts an HTTP request targeting a restricted endpoint or function within the Koji application. Because the affected component lacks proper enforcement of access control lists (ACLs) or authentication validation routines, the server processes the request as if it originated from a legitimate, authorized user.\nNetwork exposure is a primary factor in this vulnerability, as the application exposes these unprotected interfaces over standard network protocols without requiring cryptographic tokens, session identifiers, or API keys.\nDuring exploitation, the attacker bypasses the authentication perimeter entirely, enabling unauthorized interaction with backend handlers. Depending on the exposed functionality, the payload behavior may include retrieving sensitive data, modifying application state, or triggering privileged operations.\nThe post-exploitation impact includes unauthorized administrative actions, potential data exfiltration, and compromise of the underlying service integrity. Privileges required to exploit this vulnerability are none, as the flaw is explicitly unauthenticated."
}