The vulnerability exists in OpenFlagr’s HTTP middleware before version 1.1.18, where path normalization is mishandled in the whitelist logic. This allows crafted requests to evade authentication checks and reach protected API endpoints without valid credentials. An attacker who successfully exploits the flaw could alter feature flags or export sensitive data, thereby compromising the confidentiality and integrity of the system.

The affected product is OpenFlagr (Flagr). All releases up to and including version 1.1.18 are impacted. Users running any of those versions are vulnerable.

The CVSS score of 9.3 classifies this as a critical vulnerability, while an EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers generally need network or web access to the exposed API, and can target the endpoint with a specially crafted HTTP request that bypasses the authentication layer.