CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

Catalyst::Seal before 0.03 can let one request bypass authorization on a later request (CVE-2026-85491).

Robert Rothenberg disclosed CVE-2026-85491 in the Perl module Catalyst::Seal. Versions before 0.03 allow one request to disable a path or route a later request past an authorization check. The cause is a dispatch memo keyed on the request path alone. The report references the MetaCPAN distribution; the post does not say the flaw is being exploited.