A defect allows a malicious actor to bypass standard access controls by crafting URL‑encoded paths that circumvent request validation, enabling access to API endpoints reserved for higher‑permission roles. The flaw is rooted in improper path normalization (CWE‑23) and can materialize when certain request patterns trigger the sub‑optimal processing logic. The resulting privilege escalation can expose sensitive data and services within the environment, but it is limited to scenarios where the attack pattern can be executed and requires the attacker to be authenticated to the system.

Progress Chef’s Chef360 product is affected. The published fix begins with version 1.7.1; deployments using earlier releases are potentially vulnerable until the update is applied.

The CVSS score of 8.6 classifies the vulnerability as high severity. No EPSS data is available, and it is not listed in the CISA KEV catalog, so the current likelihood of exploitation is unknown but the flaw can be triggered over the network by an authenticated user leveraging the URL‑encoded path traversal. Patch availability mitigates the risk once the latest version is installed.