Summary
generated automatically from NVD dataVanus versions 0.8.0 through 0.9.0 have a missing authorization flaw (CWE-862) in the gateway, which skips permission checks on the Subscribe, Ack, and other unregistered methods. Any authenticated user can supply another tenant's subscription ID to hijack that subscription, read and acknowledge its events, and starve the legitimate consumer. Attackers can also enumerate cluster users through ListUser. The CVSS v3.1 score is 7.6 (HIGH).
NVD description
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
EPSS · FIRST.org
0.29%probability of exploitation in the next 30 days
Higher than 20% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-20, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 18 oct. 2026
- Updated
- 19 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (5)
Similar CVEs
Other vulnerabilities of type CWE-862
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.