CVE-2026-54568CWE-639CWE-862

Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info

Medium · published July 16, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
61.8
In the wild
Unconfirmed
What it is

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00977 · 61.8th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-862 · Missing Authorization
Published
2026-07-16T15:32Z
EPSS history
Timeline
  • 16 JUL 15:32Z
    Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info
    cvelistv5