Description

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T19:17:31.390Z",
  "pubdate": "2026-09-03T19:17:31.390Z",
  "executiveSummary": "The vulnerability is classified as an improper authorization flaw affecting UnoPim versions prior to 2.1.3. The security defect resides in the application's Access Control List (ACL) mapping, specifically regarding the integration store, update, and key-generation routes. By failing to register these endpoints within the Bouncer middleware's authorization enforcement layer, the system inadvertently permits users with minimal administrative privileges to execute sensitive operations reserved for higher-privileged accounts.\nThe primary impact involves unauthorized access to administrative functions, enabling malicious actors to perform privilege escalation. Specifically, an attacker can create new OAuth API integrations and generate valid client credentials, effectively granting them programmatic access to the system. This bypass circumvents standard security protocols and role-based access control (RBAC) mechanisms. Given the nature of the exploited routes, this vulnerability represents a significant security risk, as it allows attackers to establish persistent, unauthorized backdoors through OAuth integration mechanisms, leading to potential complete compromise of the UnoPim instance data and administrative management capabilities.",
  "technicalDetails": "The vulnerability stems from a fundamental failure in the application's routing security configuration within the UnoPim platform. The Bouncer middleware, which is responsible for enforcing authorization policies, lacks the necessary entries in the ACL map to govern access to specific integration-related endpoints, including the store, update, and key-generation routes. Because these paths are not explicitly defined or mapped to required capability checks within the middleware, the application fails to validate the requester's permissions before processing the request.\nThe exploitation flow begins with an authenticated user who possesses minimal administrative privileges, such as a basic admin role with limited scope. The attacker identifies the unprotected endpoints associated with OAuth integration management. By crafting malicious HTTP requests targeting these unmapped routes, the attacker successfully triggers functions within the integration controller. Since the Bouncer middleware does not intercept these requests to verify the administrative context or assigned capabilities, the backend logic proceeds as if the user possesses full administrative authority.\nThe attacker utilizes this access to interact with the OAuth API integration workflow. Step-by-step, the attacker sends a request to the integration creation route to instantiate a new API client. Following the creation of the integration, the attacker interacts with the key-generation route to mint valid client credentials (client IDs and secrets).\nOnce the attacker possesses these newly generated OAuth credentials, they can authenticate via the API as an authorized integration service. This post-exploitation activity provides the attacker with programmatic control over the UnoPim instance, bypassing the GUI-based restrictions and administrative controls. By leveraging these credentials, the attacker can systematically escalate privileges, modify sensitive data, or exfiltrate protected information from the platform. The lack of validation on the update route further allows the attacker to potentially modify existing integration configurations, ensuring persistent, unauthorized programmatic access to the system even if initial session privileges are revoked. The vulnerability is present in all versions prior to 2.1.3 and remains exposed to any user with the ability to reach the administration panel's routing interface."
}