IntentKit up to version 2.6.3 has an authorization bypass that lets any caller trigger owner‑only state‑changing tools—such as wallet transfer, posting, memory‑write, or call‑agent—even when those tools are not advertised. The executor incorrectly validates tool calls against the full catalog instead of the per‑request narrowed advertisement enforced by ToolBindingMiddleware, allowing unauthenticated or publicly exposed callers in WEB, API, Twitter, or Telegram contexts to supply a de‑advertised tool name and arguments through indirect prompt injection or replaying checkpoint and history data, thereby executing owner‑restricted capabilities without human approval.

The vulnerability affects all installations of IntentKit version 2.6.3 or earlier. Presence in the full tool registry is required; the issue is found in the core executor component used by the web, API, Twitter, and Telegram interfaces.

The CVSS score of 8.7 indicates critical severity. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attackers can leverage indirect prompt injection or replay of checkpoint and history data, including unauthenticated or publicly exposed contexts, to supply the exact de‑advertised tool name and arguments. The lack of an approval gate makes exploitation straightforward for a remote attacker, allowing complete compromise of owner‑only capabilities.