Authorization Bypass in cc-connect via Interactive Card Callbacks

The cc-connect application, specifically versions up to and including 1.5.0, contains an authorization bypass vulnerability (CVE-2026-92801) affecting the processing of Feishu interactive card callbacks. The vulnerability exists within the onCardAction handler, which fails to correctly enforce per-user allowlist filtering. In typical deployments, administrative or sensitive agent commands are protected by access control lists applied to standard text message handlers. However, by triggering interactive card actions within admitted chats, an attacker can bypass these security constraints. This allows unauthorized users to dispatch commands to the agent, potentially resulting in unauthorized execution of backend operations or information disclosure. The vulnerability is critical for organizations relying on granular access control within their Feishu-integrated chat agents, as the failure occurs at the integration logic layer rather than the platform level.

Impact

Successful exploitation allows unauthenticated or unauthorized users to perform agent-level actions that were intended to be restricted to specific users. This undermines the security model of the integration, potentially leading to unauthorized data exfiltration or administrative command execution within the connected system.

Recommendation

1. Identify all instances of cc-connect within the environment and confirm the version is 1.5.0 or lower.
2. Implement an immediate block or restriction on Feishu interactive card callback endpoints until a patched version is deployed.
3. Review access logs for the onCardAction handler to identify anomalous interaction patterns originating from users not present on authorized allowlists.
4. Monitor for agent command execution logs that correlate with incoming interactive card callbacks from unauthorized accounts.