CVE-2026-85395

UnoPim before 2.1.3 omits its integration store, update, and key-generation routes from the ACL map enforced by the Bouncer middleware, so those endpoints perform no permission check (CWE-862, missing authorization). Any authenticated user holding even minimal admin privileges can reach these routes over the network and create OAuth API integrations and mint client credentials that would normally require higher-level integration management rights. By generating API credentials and manipulating integration settings without authorization, a low-privilege admin can effectively escalate their permissions within the application beyond their assigned role. All UnoPim deployments running versions prior to 2.1.3 are affected, with self-hosted instances most exposed since the attack requires only network access to the admin panel and a low-privilege admin account. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade UnoPim to version 2.1.3 or later, which adds the integration store, update, and key-generation routes to the ACL map so the Bouncer middleware enforces permission checks. Until patched, audit existing OAuth API integrations and client credentials for any created by low-privilege admin accounts, revoke unexpected credentials, and limit admin panel access to trusted users. With no public PoC or known in-the-wild exploitation, patching in the normal cycle is reasonable, though multi-admin deployments should prioritize the update.