The vulnerability resides in the SupressNotFound middleware of the go-chi chi router. It incorrectly uses the routing context during a Match call, leaving a mounted router’s parameter and child suffix in place for the outer router. This allows an unauthenticated attacker to request a path that is mounted but whose suffix coincides with a public outer route, thereby skipping the authentication middleware that protects the mounted router and exposing tenant‑specific data. The weakness is a classic authentication bypass linked to CWE‑288.

All deployments of the go‑chi chi router using versions prior to 5.5.0, regardless of the operating system or hosting environment, are vulnerable because the middleware flaw exists in those releases.

The CVSS score of 6.3 indicates moderate severity. EPSS information is currently unavailable, and the issue is not listed in CISA’s KEV catalog. The exploit requires no special privileges; an attacker simply crafts a request to a mounted path whose suffix matches an outer public route. If such a route exists, authentication checks are bypassed and tenant data can be retrieved. Given the lack of detection mechanisms, the risk is tangible for environments that expose such routes to external networks.