Luanti 5 releases before 5.15.2 can allow a malicious module to intercept requests to an insecure environment or the HTTP API. The module runs with privileged access and can read or alter data destined for the insecure environment, thereby breaching confidentiality, integrity, or availability. The flaw is labeled CWE-670, indicating improper restriction of identities in privileged functions.

The vulnerability affects Luanti version 5.x releases older than 5.15.2. Administrators should verify the installed version and upgrade to the patched release to eliminate the risk.

The CVSS score is 8.1, denoting high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attacker must supply a malicious module, implying local or administrative access to the Luanti instance. Once the module is loaded, it can intercept requests destined for the insecure environment or the HTTP API, giving the attacker unauthorized read or modification capabilities. The likely attack vector is crafting and deploying a module that Luanti loads, which requires access to the server’s module directory. Based on the description, it is inferred that an attacker needs the ability to place a module file in a directory that Luanti scans for plugins.