A vulnerability in Luanti versions prior to 5.15.2 permits unauthorized access to sensitive HTTP APIs and environments via crafted mods, posing a high risk to server integrity.

This flaw involves an incorrect control flow implementation (CWE-670) where a malicious or compromised mod can intercept requests for secure or insecure environments if specified in the configuration, effectively bypassing intended security boundaries. The vulnerability is exploitable by an attacker capable of introducing or manipulating mods, which does not require prior authentication to the server environment itself.

The ability for a crafted mod to intercept and access restricted HTTP APIs or insecure environments can lead to complete compromise of the server configuration, data exfiltration, or unauthorized administrative actions. With a CVSS score of 8.1, this represents a high-severity risk that could lead to full system control, potentially resulting in significant operational disruption and the loss of sensitive server data.

Immediate Action: Upgrade the Luanti software to version 5.15.2 or later to resolve the underlying control flow issue.

Proactive Monitoring: Review installed mods and audit the configuration files, specifically checking the secure.trusted_mods and secure.http_mods lists for unauthorized or suspicious entries.

Compensating Controls: Restrict the ability of users to upload or install custom mods on production servers until the software has been updated to a secure version.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for total system impact, administrators should prioritize updating their Luanti instances immediately. Restricting mod permissions and auditing current configurations is essential to prevent potential exploitation until the patch is applied.