Malcolm uses its nginx Lua RBAC to control access to privileged paths. The RBAC evaluation uses the raw percent‑encoded request URI, whereas nginx routes requests based on the percent‑decoded, normalized URI. Because the RBAC check never percent‑decodes the URI, an authenticated low‑privilege user can request an admin‑only path with the URI percent‑encoded (for example, /%68tadmin.php). Nginx delivers the protected resource, and the RBAC gate finds no restriction in the raw string and grants access, enabling the user to execute privileged functions or retrieve sensitive data.

All installations of the Malcolm security information and event management system that employ the nginx Lua RBAC module are affected. The vulnerability applies to every release prior to v26.08.0, as the official advisory notes that the fix is included in that release. Companies running Malcolm expose administrative or API endpoints such as /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, and upload paths.

The CVSS score of 5.4 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack can be executed remotely over HTTP/HTTPS by any authenticated user who can send a crafted URL, requiring no higher privileges or system access beyond normal credentials. Because the exploit only manipulates the request URI, an attacker can perform it from any client or automated script.