Authorization Bypass Vulnerability in UnoPim by UnoPim
CVE-2026-85395

7.1HIGH

Key Information:

Vendor

Unopim

Status
Unopim
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85395?

UnoPim versions prior to 2.1.3 exhibit a security flaw due to missing authorization validation in the Bouncer middleware. This vulnerability permits any administrator user to bypass the access control list (ACL) restrictions, allowing them to create OAuth API integrations and mint client credentials. As a result, attackers with minimal admin privileges can escalate their permissions, leading to potential unauthorized access and manipulation of sensitive data.

Affected Version(s)

unopim 0 < 2.1.3

unopim 2.1.3

References

https://github.com/unopim/unopim/commit/acbf2e160ced78446...
patch
https://github.com/unopim/unopim
product
https://github.com/unopim/unopim/releases/tag/v2.1.3
release-notes

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.