CVE-2026-92801

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. While the text message handler applies per-user access controls, the card action handler does not, allowing attackers with low privileges in admitted chats to ...

EUVD-2026-81061

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801: Incorrect Authorization

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

PT-2026-94075

Name of the Vulnerable Software and Affected Versions cc-connect versions prior to 1.5.1 Description The software fails to enforce per-user allowlist filtering within the onCardAction handler used for Feishu interactive card callbacks. This flaw allows attackers to dispatch agent commands by...