CVE-2026-120224

Summary

A critical improper authorization flaw exists in the API Authorization component of Oray Pugongying X5 Pro up to version 7.6.1, allowing authenticated attackers to bypass intended access controls and perform unauthorized privileged operations remotely via the run_apis_by_json/run_async_task endpoints.

Exploitability

Exploitation requires valid low-privilege credentials (PR:L) and can be performed remotely without user interaction (AV:N, AC:L, UI:N).

Blast radius

Successful exploitation grants high confidentiality, integrity, and availability impact across the system (C:H/I:H/A:H), potentially enabling full compromise including data exfiltration, unauthorized configuration changes, or service disruption.

Detection

Monitor for anomalous use of the /api/run_apis_by_json or /api/run_async_task endpoints by low-privilege users, especially requests containing elevated or unexpected API parameters not typical for the user's role.

Prioritized remediation

Upgrade to Oray Pugongying X5 Pro version 7.6.2 or later; if no fixed version is available, immediately disable or restrict access to the run_apis_by_json and run_async_task API endpoints until patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.