Description
A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| will-moss | Isaiah | 1.36.0, 1.36.1, 1.36.2, 1.36.3, 1.36.4, 1.36.5, 1.36.6, 1.36.7, 1.36.8, 1.36.9 | — |
References
- VDB-377891 | will-moss Isaiah Master Websocket server.go Server.Handle authorization vdb-entry technical-description
- VDB-377891 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-15541 | CVE Analysis and Report third-party-advisory
- Submit #855074 | will-moss Isaiah 1.36.9 CWE-862 Missing Authorization third-party-advisory
- https://github.com/will-moss/isaiah/issues/34 issue-tracking
- https://github.com/will-moss/isaiah/pull/35 issue-tracking patch
- https://github.com/will-moss/isaiah/ product