CVE-2026-92801 — cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands b…
Published: 2026-09-16 · CVSS: 8.7 · CVSS 4.0
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7