CVE-2026-92801
HighCVSS 8.8Summary
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.
Risk Assessment
This allows unauthorized users to execute agent commands, potentially leading to unwanted actions and compromising system security.
Recommendation
Upgrade cc-connect to a version later than 1.5.0. Ensure access control is consistently applied across all handlers, including card actions.
Other vulnerabilities in cc-connect
See all- CVE-2026-76761High
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the shellExecCommand function of core/engine.go in the Management API allows remote OS command injection via the exec argument. The exploit is publicly available.
- CVE-2026-76760High
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the Authenticate function of core/webhook.go allows remote code injection via the exec argument. The exploit is publicly available.
Original NVD description (English source)
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.