Details
- Type
- Broken Access Control
- Impact
- Broken Access Control
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Published
- 12 October 2026
- Updated
- 15 October 2026
- Weakness
- CWE-266
Vendor fix
Upgrade to version 3.3.5-rc1.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-108899
- https://github.com/tobychui/zoraxy/pull/1291
- https://vuldb.com/vuln/416690
- https://vuldb.com/vuln/416690/cti
- https://github.com/tobychui/zoraxy/
- https://github.com/tobychui/zoraxy/commit/37cd0f27b17cd15cfa4af409bfec943146f5fdfe
- https://github.com/tobychui/zoraxy/releases/tag/v3.3.5-rc1
- https://vuldb.com/cve/CVE-2026-108899
- https://vuldb.com/submit/976047
- https://github.com/carfeii/oss/blob/main/zoraxy.md#finding-1-path-exception-rules-for-basic-auth-zorxauth-and-captcha-match-on-raw-string-prefix-not-a-path-boundary