CyberRota Analysis
AI-GeneratedThe vulnerability affects cc-connect versions up to 1.5.0, where insufficient enforcement of per-user allowlist filtering in the onCardAction handler allows attackers to execute agent commands in authorized chats. This bypass of access controls poses a significant risk, enabling unauthorized actions that could compromise sensitive information or disrupt operations. Organizations using this software should prioritize remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.