A critical authorization bypass vulnerability in cc-connect allows authenticated attackers to execute unauthorized commands via Feishu interactive card callbacks.

The application suffers from an Incorrect Authorization flaw (CWE-863) within the onCardAction handler for Feishu interactive card callbacks. This vulnerability allows an authenticated user to bypass established per-user allowlist protections that are correctly enforced in other components, such as the text message handler.

The vulnerability carries a CVSS score of 8.8, indicating a high level of severity. By bypassing access controls, an attacker can dispatch arbitrary agent commands, potentially leading to unauthorized system actions, data exfiltration, or total compromise of the connected service's functionality. This represents a significant risk to the integrity and confidentiality of communication channels integrated with the affected software.

Immediate Action: Update cc-connect to a version beyond 1.5.0 once a patch is released by the vendor, as current versions are vulnerable.

Proactive Monitoring: Review Feishu integration logs for unexpected card action callbacks or commands originating from users who are not present in the defined allowlist.

Compensating Controls: Implement strict network-level segmentation or IP-based restrictions for the Feishu callback endpoints to limit the exposure of the management interface.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for command injection via the Feishu platform, organizations should treat this vulnerability with high priority. Users are strongly advised to monitor vendor communication channels for the release of a security update and to apply the fix immediately upon availability to prevent potential unauthorized command execution.