Peplink InControl version 2, up to 2.14.2, has a flaw that permits an attacker to inject a semicolon into certain /rest/o/{orgId} API calls. This bypasses the built‑in access‑control checks, allowing unauthorized users to reach endpoints that should be restricted by organization context. The weakness is an example of CWE‑551 – Improperly Controlled Access to a Resource. If an attacker succeeds they could read or alter configuration or operational data belonging to other organizations, compromising confidentiality and integrity of the system.

The vulnerability affects Peplink InControl 2, with all releases from 2.0 up to 2.14.2 inclusive. The issue is present in all builds released before 2026‑06‑03 and has been patched in later releases.

The CVSS score of 7.7 indicates high severity. While no EPSS score is available, the lack of KEV listing does not diminish the potential impact if the software is deployed in an environment where unauthorized actors could craft API requests. The likely attack vector is through the web API: an authenticated or unauthenticated user can append a semicolon to the request path or query and force the server to treat the string as part of the organization identifier, effectively bypassing the ACL logic.