The vulnerability allows an attacker to bypass Envoy’s role-based access control when the path‑parameter stripping feature is enabled. This can lead to unauthorized access to resources that should be protected, effectively granting elevated privileges to an attacker. The weakness is identified as CWE‑863, indicating improper authorization checks.

The issue affects Envoy implementations that have path‑parameter stripping turned on. Specific affected versions are not listed in the CVE entry, so any deployment using this feature should be treated as potentially vulnerable until a vendor update is released.

Because a public description is not provided, the exact attack path is inferred from the title: an attacker would construct requests whose path parameters are stripped, causing Envoy to evaluate RBAC rules against an altered path and then allow the request. The CVSS score of 7.5 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, so known exploitation evidence is lacking. Nonetheless, the high severity and the nature of the bypass mean that an exploit, if discovered, could have a broad impact.