CVE-2026-81294
CriticalCVSS 9.8Summary
Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
Risk Assessment
The risk includes the possibility for an unauthenticated attacker to gain elevated privileges, potentially leading to unauthorized access to resources and security breaches.
Recommendation
It is recommended to upgrade Authorizer to a version newer than 3.15.1 and review permission configurations.
Other vulnerabilities in Authorizer
See all- CVE-2026-103752Critical
The Authorizer plugin in versions up to and including 3.15.3 contains an unauthenticated privilege escalation vulnerability.
- CVE-2026-54072Critical
In Authorizer prior to version 2.2.1, the /authorize endpoint accepts any redirect_uri without validating it against AllowedOrigins. With response_type=token or response_type=id_token, the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the client_id from the public /graphql endpoint.
Original NVD description (English source)
Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS