CVE-2026-85491

8.8 HIGH

Published 2026-09-24 · Updated 2026-09-25

AI risk analysis

Summary: This flaw allows an attacker to disable a path or route a later request past an authorization check by leveraging a dispatch memo keyed on the request path alone, potentially leading to unauthorized access or denial of service.
Exploitability: Exploitation is moderately hard as it requires precise control over the request path and timing, and preconditions include the presence of a vulnerable version of Catalyst::Seal.
Blast radius: If exploited, this could lead to unauthorized access or denial of service for paths that rely on specific request methods, impacting the overall security and availability of the application.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Catalyst::Seal version 0.03 or later.

auth-bypasswebperlcatalyst

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepare_action with a version that memoises how a path resolved: which dispatch type matched, at which level, and what was left over as arguments. The key is the request path and nothing else. Action roles that match on the method, content type, scheme or query make that resolution depend on state the key does not carry, so the memo answers for a request it was not built from. A path that resolves to no action is memoised as well, and replaying that entry returns without consulting any dispatch type, so no action is set and the request fails. A GET of a path whose action is declared POST-only therefore disables that path for every later request, the correct POST included. An entry that did resolve replays the level the earlier descent reached. Where a POST-only action sits below a shallower action on the same path, a GET memoises the shallow route, and a later POST is dispatched there with an auto() guarding the deeper controller never running. The memo is cleared only when an action is registered, which happens at setup, so an entry lasts for the life of the process, and its cap of 2048 entries bounds how many paths one caller can disable. In the configuration measured, the misroute lands on the less privileged action, so it is an authorization check not running rather than a privilege gain.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-706, CWE-1023

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.