The incorrect authorization flaw lets an unauthenticated attacker execute CGI scripts that should be gated by directory‑based access controls. The issue arises when a ScriptAlias maps a URL prefix to a directory outside the DocumentRoot; in this case mod_auth checks permissions against the DocumentRoot‑relative path, whereas mod_cgi runs the script at the physical path resolved by ScriptAlias. Because the two paths differ, the authentication rules never apply to the executable script, so it can be invoked without authentication. The affected components include the inets HTTP server modules lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl and lib/inets/src/http_server/mod_cgi.erl, and the vulnerability exists in Erlang/OTP versions from 17.0 up to, but not including, 26.2.5.19, as well as OTP 27.3.4.10 and OTP 28.4.2.

The Erlang/OTP runtime, specifically the inets HTTP server module, is affected. Versions from OTP 17.0 up to, but not including, OTP 26.2.5.19, as well as OTP 27.3.4.10 and OTP 28.4.2, are vulnerable. Any installation using ScriptAlias to expose CGI scripts is potentially at risk.

With a CVSS score of 8.3 the flaw is classified as high severity. The EPSS score is < 1% and it is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to a URL under a ScriptAlias prefix, which the CGI module will execute regardless of directory rules. Exploitation requires only that a CGI script exists outside the DocumentRoot; the attacker can trigger its execution without authentication. The complexity of the attack is low and the impact is potential unauthorized execution of scripts, which could compromise the server if those scripts perform sensitive operations. Given these factors, the vulnerability poses a significant risk to affected systems.