Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-85395UnoPim before 2.1.3 Missing Authorization on Integration Management Routes
High 7.1
In plain English
A high-severity missing authorization in unopim from unopim. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 63.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
References
- Patch Commit patch
- https://github.com/unopim/unopim product
- UnoPim v2.1.3 Release Notes release-notes
- https://github.com/unopim/unopim/blob/v2.1.2/packages/Webkul/User/src/Http/Middleware/Bouncer.php technical-description
- https://github.com/geo-chen/oss/blob/main/unopim.md technical-description
- VulnCheck Advisory: UnoPim before 2.1.3 Missing Authorization on Integration Management Routes third-party-advisory