CVE-2026-124680

HighCVSS 7.0/10Last modified Nov 13, 2026

Description

Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.

An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments.

This issue affects Apache APISIX: from 0.9 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Metrics

CVSS 4.0 7.0/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-436

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1246838.7Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTok CVE-2026-1246845.1This issue can cause a heap-use-after-free when an embedder unloads a ReloadableString buffer while a previously returned raw character poin CVE-2026-1246865.4In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an inv CVE-2026-1246877.1In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection th CVE-2026-1246887.1In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `sprit CVE-2026-1246897.1In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and CVE-2026-124694.3Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a craft CVE-2026-1246907.1In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can inf CVE-2026-1246917.1In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task t CVE-2026-1246927.1In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue r CVE-2026-1246937.1In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names CVE-2026-1246947.1In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property valu