The vulnerability arises from a missing authorization check in the Vanus gateway that handles streaming RPCs. Any authenticated user can invoke the Subscribe, Ack, and even unregistered methods without permission validation. This permissiveness allows an attacker to supply a subscription ID belonging to another tenant, thereby hijacking that subscription, reading and acknowledging its events, or starving the legitimate consumer. The attacker can also enumerate cluster users via the ListUser method, revealing tenant and user information. The weakness is categorized as CWE-862: Missing Authorization. The impact is that an attacker can gain unauthorized access to tenant event streams, manipulate acknowledgments, and perform enumeration, leading to data confidentiality loss and potential denial of service for legitimate consumers.

The affected product is vanus-labs:vanus, specifically the gateway component of Vanus versions 0.8.0 through 0.9.0. Any installation of these versions that exposes the gateway RPC interface to authenticated users is vulnerable. Versions prior to 0.8.0 or later than 0.9.0 are not known to be affected.

The CVSS score of 7.2 indicates a medium severity vulnerability that enables a privilege escalation type of attack for authenticated users. The EPSS score is not available, so the current probability of exploitation cannot be quantified, but the lack of KEV listing and the absence of readily available public exploits suggest a moderate likelihood. An attacker who has valid credentials, whether through compromise or legitimate access, can exploit the voting RPC endpoints to hijack streams, read other tenants’ data, or enumerate users. The attack vector is via any authenticated session, implying that the risk surface is broad for environments where credentials are widely distributed or weakly protected.