Authorization Bypass Vulnerability in elixir-grpc by Elixir

CVE-2026-48599

What is CVE-2026-48599?

An authorization bypass vulnerability present in the elixir-grpc framework allows authenticated attackers to manipulate requests and gain unauthorized access to resources of other users. By embedding a conflicting value in the path-bound fields via query strings or request bodies, an attacker can exploit the low merge precedence used in the server's request processing. This flaw occurs in the map_request function within the Elixir.GRPC.Server.Transcode module, permitting attackers to bypass essential authorization checks and potentially wield control over other users' data and operations.

References