CVE-2026-94269

MediumCVSS 6.3/10Last modified Oct 1, 2026

Description

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX.

In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0.

Users are recommended to upgrade to version 3.19.0, which fixes the issue.

Metrics

CVSS 4.0 6.3/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-647

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-94278.8A flaw has been found in Edimax EW-7438RPn 1.31. This impacts the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the comp CVE-2026-942705.3The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and sh CVE-2026-942715.3The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from CVE-2026-942725.3The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authoris CVE-2026-942735.3The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approve CVE-2026-942745.3The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, incl CVE-2026-942755.3The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, CVE-2026-942765.1Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authori CVE-2026-942776.3MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via spri CVE-2026-942785.5The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachmen CVE-2026-94288.8A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSettin CVE-2026-942816.5An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an at