{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wimoor/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wimoor:wimoor:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-111691"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WIMOOR (\u003c= ec86736)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","web-application","cloud"],"_cs_type":"advisory","_cs_vendors":["WIMOOR"],"content_html":"\u003cp\u003eWIMOOR through commit ec86736 is susceptible to an authentication bypass vulnerability. The flaw exists because the application incorrectly processes the unsigned 'X-USERINFO' HTTP header when backend service ports are accessed directly, bypassing the intended gateway or proxy authentication mechanisms. By manipulating the 'companyid', 'manager', or 'admin' fields within this header, an unauthenticated attacker can successfully impersonate any tenant, including administrative accounts. This flaw allows unauthorized actors to read and modify sensitive internal information, including order histories, financial records, and Amazon seller authorizations. This represents a significant risk to organizations using WIMOOR, particularly if backend instances are reachable from untrusted network segments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full tenant impersonation and unauthorized access to sensitive business operations. Attackers can view or manipulate financial data, modify order processing, and compromise third-party integrations such as Amazon seller authorizations, potentially leading to significant financial loss and operational disruption for users of the platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately restrict network access to WIMOOR backend service ports to ensure all traffic must traverse the authorized gateway, preventing direct access.\u003c/li\u003e\n\u003cli\u003ePatch WIMOOR by updating to a version beyond commit ec86736, ensuring that the application validates the authenticity of 'X-USERINFO' headers instead of relying on client-provided data.\u003c/li\u003e\n\u003cli\u003eReview web application firewall (WAF) logs for any incoming requests containing custom 'X-USERINFO' headers, which should be considered anomalous if originating from external or non-internal-gateway IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:50:23Z","date_published":"2026-10-16T18:50:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wimoor-auth-bypass/","summary":"WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows unauthorized tenants to escalate privileges and access sensitive financial data by forging the unsigned X-USERINFO header.","title":"Authentication Bypass in WIMOOR via Unsigned X-USERINFO Header","url":"https://feed.craftedsignal.io/briefs/2026-10-wimoor-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - WIMOOR","version":"https://jsonfeed.org/version/1.1"}