The flaw lies in Malcolm's nginx Lua access‑control layer. It checks the raw, percent‑encoded request URI against a list of blocked paths but then lets nginx route the request based on its own percent‑decoded, normalized URI. Because the check never decodes its input, an attacker who has any authenticated access can request an admin‑only path using percent‑encoding, causing nginx to deliver the restricted content while the RBAC layer allows the request. The result is a privilege‑escalation that permits a low‑privileged user to reach fully‑restricted endpoints such as /htadmin, /auth, or /arkime/api/esadmin. This is a CWE‑863 – Incorrect Authorization flaw.

The vulnerability affects the CISA Malcolm platform, specifically the nginx Lua role‑based access control component used in versions prior to 26.08.0. The affected installation includes the Nginx instance that serves the web interface for admin paths.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, so its exploitation probability cannot be quantified, and it is not listed in the CISA KEV catalog. Exploitation requires a user to be authenticated with a low‑privilege role and to have the ability to send arbitrary HTTP requests to the Malcolm instance. The attack path is simple and requires only normal web‑client access, making it a realistic threat for internal users who can enumerate admin paths.