Cpe:2.3:a:intentkit:intentkit:*:*:*:*:*:*:*:*

IntentKit versions 2.6.3 and earlier contain an authorization bypass vulnerability allowing unauthenticated actors to execute restricted, state-changing tools by bypassing intended ToolBindingMiddleware per-request scoping.