A critical access control vulnerability in my-site version 1.0.2 allows unauthenticated remote attackers to bypass security checks and access sensitive system components.

The vulnerability exists in the cn.luischen.interceptor.BaseInterceptor class, where improper implementation of the preHandle function fails to enforce necessary authentication checks. This allows an unauthenticated attacker to interact with restricted system components over the network.

The exposure of sensitive components to unauthenticated users creates a significant risk of unauthorized data disclosure. With a CVSS score of 7.5, this vulnerability is categorized as High severity, as it enables attackers to circumvent intended security boundaries without requiring any valid credentials or user interaction.

Immediate Action: Since a specific patch version is currently unknown, administrators should review the GitHub issue tracker for updates from the project maintainer and restrict network access to the affected instance as a temporary measure.

Proactive Monitoring: Monitor server access logs for anomalous requests directed toward sensitive endpoints or unexpected patterns originating from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests targeting the vulnerable BaseInterceptor functionality until a permanent software fix is applied.

Public Exploit Available: Unknown

Given the high severity of this vulnerability and the confirmed existence of proof-of-concept material, immediate attention is required. Organizations utilizing my-site should isolate the affected service from public networks and prioritize applying official security updates as soon as they are released by the vendor.