Nebula Mesh’s web UI (/ui/*) in versions 0.3.5 and earlier does not apply the per‑operator certificate authority scoping that the JSON API enforces. Although the referenced GHSA-598g-h2vc-h5vg offered a partial fix, the changes were not deployed to the UI’s read and mutation endpoints. Consequently, any authenticated non‑admin operator—such as a self‑registered or OIDC user—can view or modify resources belonging to other operators. The UI routes that manage host creation, editing, mobile‑bundle handling, and network creation are correctly scoped, but other routes bypass the authorization checks, allowing attackers to read hosts and networks and, more critically, to block or delete other operators’ hosts. This represents a misuse of authority (CWE‑639) and a missing authorization check (CWE‑862).

The vulnerability affects Nebula Mesh installations produced by Juev that run version 0.3.5 or earlier. Version 0.3.6 contains the fix that restores per‑operator scoping in the web UI.

The CVSS score of 8.8 indicates high severity, but the EPSS score of < 1 % shows a very low probability of exploitation in the general threat landscape, and the flaw is not yet listed in the CISA KEV catalog. Exploitation requires authenticated access to the web UI by a non‑admin operator; it does not provide remote code execution or arbitrary data exfiltration beyond the operator’s authorized scope. The practical risk is therefore significant for deployments supporting multiple operators, especially when non‑admin accounts are plentiful or poorly managed.