{"schema":"threatline.record/2","record":{"id":"CVE-2026-118681","aliases":["GHSA-rqrp-8cg2-5958"],"summary":"go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware","details":"go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.","categories":["Unclassified"],"product":"chi","vendor":"go-chi","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118681","source_modified_at":"2026-10-28T18:59:52.523Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"chi","vendor":"go-chi","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"5.5.0"},{"version":"5.5.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118681","source_modified_at":"2026-10-28T18:59:52.523Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"chi","ecosystem":null},"version":"5.5.0","basis":"first unaffected version stated in the CVE record"}],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T18:59:52.523Z","modified_at":"2026-10-28T18:59:52.523Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118681","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T18:59:52.523Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/go-chi-chi-before-5.5.0-authentication-bypass-via-supressnotfound-middleware","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T18:59:52.523Z","content_hash":"8ab99f6388a2776d3cb5a60fa05e5991f980b245698a1c712bb7e314457ef98a"}}