CVE-2026-62927

This CVE exposes an authorization bypass in Eclipse Milo's Call service that stems from a structural mismatch: the service validates authorization at the batch level but dispatches individual calls to handlers without enforcing that decision. The authorization decision and enforcement operate on different objects—an architectural inversion that fundamentally breaks the security model. The flaw affects versions 1.0.0 through 1.1.4, meaning it shipped with the project's initial release. The batching mechanism was designed without ensuring authorization boundaries respected dispatch granularity. This is the same cognitive failure pattern behind XML parser entity expansion bypasses, SMTP relaying vulnerabilities, and message queue access control flaws—developers model authorization around the interface they control, not around the dispatch semantics of what they're forwarding downstream. For industrial control environments, the risk profile differs from what standard metrics suggest. The 7.5 CVSS captures technical severity but may underweight physical-world consequences when method execution triggers actual processes in power systems, water treatment, or manufacturing. The EPSS score of 0.00298 reflects opportunistic scanning against internet-facing hosts; it does not model the realistic threat vector in OT environments, where attackers achieve access through trusted network segments and pivot laterally within ICS networks. Low EPSS in this context means the exploitation model doesn't match how these systems are actually compromised. When evaluating the patch, determine whether it filters batches before dispatch or restructures authorization to evaluate per-call. If filtering was applied at dispatch, the fix patches the symptom while leaving the architectural assumption intact—future developers adding handler paths may reintroduce the bypass. If authorization was restructured to per-call, assess performance impact; if it degrades batching significantly, operational pressure may push teams toward disabling batching entirely, trading one vulnerability for insecure configuration. Document any new dispatch paths to ensure consistent filtering. Industrial deployments running Eclipse Milo in SCADA, power management, or infrastructure contexts often have multi-year patch latencies measured in quarters. The vulnerable state persists in production long after the fix is available.

Reviewed through automated stages and approved by a human before publication.