{"uuid": "49252adb-6334-4d13-881e-c8a0a4017564", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48599", "type": "seen", "source": "https://gist.github.com/alon710/de2f443dedb4eb6745ce771bf61c5306", "content": "# CVE-2026-48599: CVE-2026-48599: Authorization Bypass in elixir-grpc/grpc Transcoding Layer\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48599\n\n## Summary\nAn authorization bypass vulnerability exists in the elixir-grpc/grpc library version 0.8.0 up to 1.0.0. Due to insecure map merging precedence inside the HTTP-to-gRPC transcoding engine, query-string parameters and request bodies can override routing path variables, allowing attackers to execute unauthorized actions on other accounts.\n\n## TL;DR\nAn insecure Map.merge sequence in the elixir-grpc transcoding layer allows attackers to bypass tenancy controls by overriding authoritative path parameters via HTTP parameter pollution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.6 (High)\n- **EPSS Score / Percentile**: 0.00273 / 19.15%\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- elixir-grpc/grpc\n- **elixir-grpc/grpc**: >= 0.8.0, < 1.0.0 (Fixed in: `1.0.0`)\n\n## Mitigation\n\n- Upgrade to elixir-grpc/grpc version 1.0.0 or higher\n- Implement validation logic inside the gRPC service handler using authentication headers\n- Configure API Gateways to strip conflicting query parameters\n\n**Remediation Steps:**\n1. Modify your mix.exs file to pin grpc to version 1.0.0 or later.\n2. Run mix deps.get and mix deps.compile to fetch the patched library.\n3. Deploy the updated application to production environments.\n\n## References\n\n- [GHSA-mwr4-5g34-j5cq: Authorization Bypass in elixir-grpc/grpc](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq)\n- [Fix http transcode binding priorities](https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4)\n- [Erlang Ecosystem Foundation Advisory](https://cna.erlef.org/cves/CVE-2026-48599.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48599) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T10:31:32.228017Z"}