Technical impact
Eclipse Milo Call service incorrectly re‑dispatches batched requests to address‑space handlers after performing authorization checks. An unauthorized or anonymous client can place a denied request method in the same batch as an allowed method, causing the denied method to be executed. This leads to a privilege escalation or unauthorized operation that the caller is not permitted to perform. The weakness is a Client Side Permission Conflict as defined by CWE-863.
Affected Systems
The issue affects Eclipse Foundation’s Eclipse Milo library, versions 1.0.0 through 1.1.4. These releases expose the Call service’s batch handling flaw. Any deployment using one of these versions is vulnerable.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity, and the EPSS score is not reported, so the exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves network traffic to the Call service endpoint; an attacker can craft a mixed batch over the wire to trigger the flaw. Because the flaw bypasses authorization after dispatch, it can be used to execute privileged methods on behalf of a low‑privileged or unauthenticated user.
