What’s Vulnerable › Vulnerabilities

CVE-2026-85395: UnoPim before 2.1.3 Missing Authorization on Integration Management Routes

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-03 · updated 2026-09-23
• Weakness: CWE-862

Description

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.

Affected products

• unopim: before 2.1.3 — fixed in 2.1.3

How to fix

Upgrade to a fixed version: unopim 2.1.3. Check the vendor advisory for mitigations.

References

• https://github.com/geo-chen/oss/blob/main/unopim.md
• https://github.com/unopim/unopim
• https://github.com/unopim/unopim/blob/v2.1.2/packages/Webkul/User/src/Http/Middleware/Bouncer.php
• https://github.com/unopim/unopim/commit/acbf2e160ced78446d6e4267e89f264bf04612c4
• https://github.com/unopim/unopim/releases/tag/v2.1.3
• https://www.vulncheck.com/advisories/unopim-before-2.1.3-missing-authorization-on-integration-management-routes
• https://github.com/geo-chen/oss/blob/main/unopim.md

Get alerted when CVE-2026-85395 or the next vulnerability affects your stack