Malcolm's nginx reverse proxy has an inconsistency between the Lua-based role‐based access control (RBAC) layer and nginx’s own path normalization. An authenticated user can craft a special URL that evades RBAC checks and accesses restricted endpoints such as file upload, PHP server, admin panels, and authentication management interfaces. The vulnerability enables the attacker to gain unauthorized administrative privileges and manipulate protected resources.

All Malcolm installations that use the default nginx reverse proxy and RBAC configuration. The issue applies to every restricted path protected by the Lua RBAC layer, including upload services, PHP backends, the htadmin interface, and authentication management endpoints.

The CVSS score of 8.1 indicates a severe impact and a high level of exploitation risk. The EPSS score is unavailable, but the lack of a KEV listing suggests the vulnerability is not yet a known, actively exploited weakness in the wild. The attack path requires the user to be authenticated to Malcolm, implying the attacker must compromise valid credentials or gain access through an existing authenticated session. Once authenticated, the attacker can construct a request path that bypasses RBAC checks, achieving unauthorized access to administrative functions. Because the flaw resides in path normalization logic, it is not limited to specific hosts or services, raising the potential for widespread damage across all affected Malcolm deployments.