Wazuh dashboard plugins from version 4.9.0 up to but not including 4.14.9 contain an authorization bypass flaw that permits authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. By inserting nested body.headers.Authorization values into the request payload, an attacker can replace the server‑side session Bearer token and effectively act as another Manager API identity or issue unauthenticated upstream requests. This is an instance of CWE‑863, a disclosure of unauthorized information or modification through insufficient authorization checks.

The affected product is the Wazuh Dashboard Plugins produced by Wazuh, incorporated in releases from 4.9.0 through 4.14.8. The vulnerability is present across all platforms supported by these versions, as identified by the CPE cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*.

The vulnerability has a CVSS score of 8.8, indicating high severity. EPSS data is not available, so the current exploitation probability is unknown, but the high score suggests a serious risk if the flaw is discovered. It is not listed in the CISA KEV catalog, meaning no publicly known exploit has been reported. Attackers require an authenticated dashboard session to exploit the flaw; once authenticated, they craft a JSON request to /api/request containing a nested Authorization header that the server substitutes for the valid token. This bypass could allow unauthorized access to Manager API endpoints or enable the attacker to perform privileged actions on behalf of other users or bypass authentication entirely.