A request to a Catalyst::Seal application can create an entry in a dispatch memo that is keyed only on the request path. This memo can be reused for subsequent requests regardless of their method, content type, or query. As a result, a POST‑only route can be disabled by a preceding GET, or a less privileged route can be dispatched instead of a deeper, more privileged one. The vulnerability allows an attacker to bypass authorization checks by reusing or replaying these memo entries, potentially enabling execution of actions that are otherwise protected.

Perl applications that use Catalyst::Seal versions earlier than 0.03 are affected. The flaw is present in Catalyst::Seal 0.02 and any earlier releases. Upgrading to 0.03 or later removes the memoization logic that uses only the request path as a key.

The vulnerability can be exploited remotely by sending crafted HTTP requests to the target application. An attacker does not need elevated privileges to mount an attack; merely the ability to send requests to the web server is sufficient. The exploit does not require any known public exploits, but the EPSS score <1% indicates a low probability of exploitation. The existence of the flaw and its ability to bypass authorization checks suggests a high likelihood of targeted exploitation in environments where Catalyst::Seal is deployed. The CVSS score 8.8 indicates the flaw has high severity. The flaw is not listed in the CISA KEV catalog, indicating no confirmed real‑world exploitation at the time of this analysis.