The vulnerability stems from the /api/v1/* routes in nebula‑mesh, which trust only the bearer token for authorization. The code at internal/api/hosts.go:384 confirms that API authorization relies solely on the token, with per‑CA ownership enforced only in the Web layer. This omission lets any non‑admin operator use their token to access and modify other operators’ CAs, hosts, networks, firewalls, and mobile bundles, enabling cross‑operator privilege escalation. Tagged CWE‑862, the flaw gives a CVSS score of 9.9. The issue is resolved starting with version 0.3.4.

The vulnerability affects the self‑hosted control plane nebula‑mesh from juev. Any instance running a version prior to 0.3.4 is susceptible, regardless of deployment size or configuration. Operators using older releases should assess their current token distribution and access policies before upgrading.

The CVSS score of 9.9 indicates an extremely severe potential impact if the vulnerability is exploited. However, the EPSS score of less than 1% suggests that, based on current threat intelligence, exploitation instances are rare. Attackers would still need a valid bearer token with non‑admin privileges – resulting in a legitimate or compromised operator abusing their token. The vulnerability is not listed in the CISA KEV catalog, but the high severity still warrants immediate remediation.