Authorization Bypass in Catalyst::Seal for Perl

CVE-2026-85491

What is CVE-2026-85491?

Catalyst::Seal prior to version 0.03 for Perl contains a vulnerability where improper memoization of request paths allows an authorization bypass. This occurs as the dispatcher incorrectly stores paths, leading to scenarios where a GET request can disable a POST-only action for subsequent requests. The vulnerability permits unauthorized access to routing paths, failing to utilize appropriate authorization checks, reducing the application's security posture. Action roles that depend on various request attributes may not be correctly recognized, putting affected systems at risk.

References