A flaw in HarnessRouter’s Identity Mode processing of the X‑Harness‑Org and X‑Harness‑Member HTTP headers allows an attacker to bypass the intended authorization checks. By manipulating these headers an attacker may gain access to resources or perform actions that should be restricted to authorized organizational members, potentially exposing sensitive data and impacting confidentiality and integrity. The vulnerability is an authorization weakness as classified by CWE‑266 and CWE‑285.

The vulnerability exists in HarnessRouter versions up to 0.31.10. Updating to 0.31.11, which includes the patch identified by commit 48a26cdf9c4544d2c88d1a07f0777f063f1d753f, eliminates the flaw. All users running the affected product should verify that they are not using an earlier release.

With a CVSS score of 6.3 the vulnerability is rated medium severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating it is not actively exploited at this time. However, the attack vector is remote, the complexity is high, and the exploitability is noted as difficult, meaning that while an attacker can potentially exploit the flaw, it would require significant effort and knowledge. Still, the risk of unauthorized access warrants prompt remediation.