This issue is due to improper handling of URL-encoded paths during request processing. In certain scenarios, an authenticated request may bypass standard access controls gaining additional privileges, potentially allowing access to API endpoints that are intended to be restricted to higher-permissioned roles.  The impact is limited to environments where the affected request patterns can be triggered and depends on specific deployment configuration and access controls in place. 

The issue is related to insufficient validation and normalization of URL-encoded paths. This may result in path traversal behavior that bypasses expected authentication and authorization checks. 

The issue has been addressed through product updates that improve request validation and enforce strict path normalization before authorization checks.

Customers are advised to update to the latest available version containing the fix, version 1.7.1 or later. 

If an immediate upgrade is not possible, consider the following temporary measures as mitigation:

• Restrict access to API endpoints to trusted networks
• Apply additional filtering or validation at ingress (e.g., WAF rules)
• Monitor for unusual API request patterns involving encoded URLs

Customers are encouraged to:

• Apply the latest updates at the earliest opportunity
• Review access controls for API endpoints
• Follow standard security best practices for exposure management