CVE-2026-5458: Broken Access Control in Senate Core JSON API (CWE-662)

Vulnerability Key Information Summary Vulnerability Overview Vulnerability ID: CVE-2026-5458 Vulnerability Type: Eval Injection Affected Component: 's JSON API routes Description: The state-changing routes in 's JSON API (e.g., , , , ) do not enforce the permission. Since only the route enforces this permission, anonymous or low-privilege callers can still access these state-changing routes, leading to privilege escalation (CWE-662, Insufficient Privilege). Scope of Impact Affected Routes (gated routes): - , - - , - Risk: Anonymous or low-privilege users can execute state-changing operations, resulting in Broken Access Control. Remediation A new shared helper function was added in . It is invoked on the target object and serves as the single source of truth for permission validation. State-changing routes now call this helper function, moving the permission check outside of the route handler function, implementing it as part of . The view wrapper causes unauthorized access to return a JSON error ( ) instead of HTTP 401; the behavior of the route remains unchanged. A new regression test was added, covering interception of anonymous and low-privilege (Member) callers on all gated routes. Unit tests now load to make views available in tests. Note: CSRF hardening (removing ) is out of scope for this PR and will be addressed separately. PoC / Exploit Code No specific PoC or exploit code block is included in the page; it contains only implementation and testing notes. The relevant test file is (regression test), but its code content is not displayed on the page.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-5458: Broken Access Control in Senate Core JSON API (CWE-662)

More from this source