The vulnerability allows an authenticated low‑privilege user to bypass role‑based access control by crafting a URI that contains path traversal segments. Because the Lua RBAC layer evaluates the raw, unnormalized request URI while Nginx routes the request using a normalized path, the access check fails to match any rule and permits the request to a restricted backend. This results in unauthorized access to resources that should be protected.

The flaw affects the Malcolm network traffic analysis suite distributed by cisagov. Versions prior to 26.07.0 are affected; the issue is resolved in release 26.07.0 and later.

The CVSS score of 7.1 indicates high impact, but the EPSS score is below 1% and the vulnerability is not listed in CISA KEV, suggesting limited exploitation likelihood. Attacks would be launched via normal HTTP requests directed at the Malcolm application, exploiting the differential between URI normalization in Nginx and the Lua RBAC check.