CVE-2026-55089

The core vulnerability in CVE-2026-55089 is not a missing authorization check — it is a semantic confusion between 'claim required' and 'claim truthy.' The OAuth2Provider correctly issues `admin: false` for non-admin users. The APIHandler then checks only whether the `admin` claim exists in the token, not whether it evaluates to true. This means every valid, correctly-signed token passes the authorization gate simply by having any value for `admin`, including `false`. The token is valid; only the authorization logic is broken. This pattern — checking attribute presence rather than attribute value — is a recurring failure mode in claim-based systems. JWT-based RBAC is particularly susceptible because developers assume the mere presence of a role claim implies authorization, when the value determines access. The vulnerability rewards an attacker who already possesses a legitimately issued token; no signature bypass, no token forgery, no injection is required. The affected endpoints — listAllPads, deletePad, restoreRevision — are instance-level administrative functions, not pad-level operations. This means a single successful exploitation grants enumeration and deletion access across every pad in the deployment. The CVSS of 9.9 reflects this geometry accurately. The fix requires two changes. First, the OAuth2Provider should omit the `admin` claim entirely for non-admin users rather than issuing `admin: false` — claim-based systems should enforce a 'no false values, only absent values' schema. Second, the `requiredClaims` implementation should be audited across the entire codebase and plugin ecosystem, because this semantic trap creates a class of vulnerabilities, not a single instance. The operational consequence is compounding: because exploitation uses a legitimately signed token, it generates legitimately authorized logs — anomalous behavior detection based on authentication failures or malformed requests will produce no signal. The EPSS of 0.00355 likely reflects that this specific OAuth configuration is rare in production, not that the bug is hard to exploit. Organizations reading the EPSS should weigh whether the requirement for a valid OAuth token significantly constrains their attack surface — but any compromised or misconfigured OAuth client with a valid token becomes a full-instance compromise vector.

Reviewed through automated stages and approved by a human before publication.