CVE-2026-124716

MediumCVSS 6.4/10Last modified Nov 13, 2026

Description

Incorrect Authorization vulnerability in Apache APISIX.

An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied.

This issue affects Apache APISIX: from 1.4.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Metrics

CVSS 4.0 6.4/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1247192.3Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenA CVE-2026-124725.3The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions u CVE-2026-1247236.3Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With match_uri_encoded_slash enabled and skip CVE-2026-1247266.9Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the Open CVE-2026-124738.2Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A g CVE-2026-1247377.5A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standar CVE-2026-1247385.3A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only CVE-2026-1247397.5A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigge CVE-2026-1247404.3A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by respo CVE-2026-1247417.6A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copyin CVE-2026-1247425.5A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially form CVE-2026-1247435.5A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header valu