Description

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-01T15:17:41.613Z",
  "pubdate": "2026-09-01T15:17:41.613Z",
  "executiveSummary": "A critical vulnerability exists in Cleo Harmony, specifically within the JWT Refresh Token Handler processing the /api/connections endpoint.\nThis flaw involves improper privilege management triggered by malicious manipulation of the Bearer argument.\nThe vulnerability allows remote, unauthenticated, or low-privileged attackers to bypass standard access controls, potentially escalating privileges to perform unauthorized administrative actions.\nThe flaw affects Cleo Harmony versions up to 5.8.1.10.\nGiven that exploit code is publicly available, the risk to affected systems is high, necessitating immediate remediation.\nExploitation is conducted remotely over the network without requiring complex user interaction, presenting a significant threat to internal application security and data integrity.",
  "technicalDetails": "The vulnerability resides in the JWT Refresh Token Handler, a critical component responsible for maintaining session state and authorizing user access within the Cleo Harmony platform.\nThe root cause is identified as improper privilege management within the /api/connections endpoint. The application fails to adequately validate or sanitize the input provided via the Bearer token argument during the token refresh process.\nThe attack vector involves a remote request targeting the /api/connections endpoint. By manipulating the Bearer argument—specifically injecting crafted or malformed JSON Web Token (JWT) data—an attacker can bypass existing authorization checks.\nThe JWT Refresh Token Handler logic incorrectly evaluates the token's claims or signature integrity, allowing the attacker to assume a security context or privilege level not assigned to the original session.\nIn the context of the attack flow, the adversary sends a specially crafted POST or GET request to the vulnerable endpoint with the manipulated Bearer token. The server-side component processes this request by decoding the JWT provided in the header. If the validation logic is flawed, the component grants the requested operations associated with higher-level privileges, effectively performing an unauthorized privilege escalation.\nBecause this component handles connection-related operations, the post-exploitation impact includes the potential to manage or view sensitive connection configurations, facilitate data exfiltration, or modify administrative settings within the application.\nThe vulnerability is exploitable remotely, allowing adversaries to execute the attack from any network location with access to the web interface. Since the exploit is already public, the barrier to entry for potential attackers is low, increasing the urgency for patch deployment.\nThe flaw is constrained to the specific implementation of the JWT handler in the affected versions (up to 5.8.1.10). Once the manipulated token is accepted by the handler, the internal security state of the session is compromised, leading to unauthorized resource access until the session is invalidated or the service is patched."
}