Mockoon’s admin API user‑defined mock routes. The API allows privileged operations such as writing arbitrary process environment variables, modifying mock route bodies and headers, and accessing transaction logs. The lack of authentication (CWE‑306) and unrestricted write authorization (CWE‑732) give an attacker full control over the mock server environment. Based on the description, the likely attack vector involves a remote attacker who can connect to the mock server port, for example via a web browser exploiting the wildcard CORS header (Access‑Control‑Allow‑Origin: *). exfiltration.

All installations of Mockoon prior to version 9.7.0 are affected. The vulnerability resides in the commons‑server/src/libs/server/admin‑api.ts, which is mounted on the same Express listener as user‑defined routes. Users running any shipped runtime before this patch on any platform should consider the product vulnerable until they upgrade to 9.7.0 or later.

The CVSS score of 8.8 classifies the issue as high severity, and the EPSS score is < 1 %. While the likelihood of exploitation in the wild is low, the absence of an authentication barrier and the ability to modify environment variables and request handlers mean that a remote attacker who can reach the server port can exploit the flaw with relatively low effort. The vulnerability is not listed in CISA’s KEV catalog, yet its destructive potential warrants immediate attention, especially in environments exposed to the public internet.