PT-2026-49532 · Elixir Grpc+1 · Grpc

Jonatan Männchen + 2 · Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-48599

Positive Technologies (AI Summary)

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions elixir-grpc versions 0.8.0 through 0.9.x

Description Authenticated attackers can access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body. This occurs in the map request/5 function within Elixir.GRPC.Server.Transcode (lib/grpc/server/transcode.ex), where Map.merge/2 is used with path bindings as the first argument, granting them the lowest merge precedence. Consequently, a request such as 'GET /users/me/profile?user id=victim' or a POST request containing user id in the body results in a decoded protobuf struct where the path-bound field is overwritten by the attacker-supplied value. This allows the bypass of handlers using these fields for authorization, ownership checks, or multi-tenancy scoping. This issue requires HTTP-to-gRPC transcoding to be enabled.

Recommendations Update to version 1.0.0 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-48599

GHSA-MWR4-5G34-J5CQ

Affected Products

Grpc

References · 6

• https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq · Vendor Advisory
• https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4 · Patch
• https://osv.dev/vulnerability/EEF-CVE-2026-48599 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48599 · Security Note
• https://cna.erlef.org/cves/CVE-2026-48599.html · Note
• https://hex.pm/packages/grpc · Note