Netmaker employs the Authorize middleware to verify host JWT tokens, but prior to version 1.5.0 a flaw allowed a token that simply matched the hostAllowed flag to pass all subsequent authorization checks without confirming the host’s specific rights. As a result, any party possessing a valid host token and knowledge of object identifiers such as node or host IDs could reach endpoints that permit retrieval, modification, or deletion of resources belonging to other hosts, including node information, host deletion, MQTT signalling, fallback host updates, and failover operations. The weakness is an instance of CWE‑863: Authorization Bypass Through User-Controlled Key.

The vulnerability affects the Netmaker product by the vendor gravitl. All releases before v1.5.0 are impacted. Endpoints listed in the advisory – node info retrieval, host deletion, MQTT signal transmission, fallback host updates and failover operations – lack proper authorization checks for host tokens.

The CVSS score of 8.6 indicates high severity while the EPSS score of less than 1% shows that exploitation is unlikely to be widespread or automated. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to hold a valid host JWT token and knowledge of target identifiers, making the exploit considered feasible by an actively privileged or compromised host but not easily achievable by external unauthenticated actors. Nevertheless, the impact once exploited can be significant due to the full range of accessible resources.