CVE-2026-68548

Name of the Vulnerable Software and Affected Versions Algernon versions prior to 1.17.10

Description An authorization bypass exists in the URL-prefix authorization gate. The server uses case-sensitive string matching to protect prefixes such as /admin, /repo, and /data. However, on case-insensitive filesystems like Windows NTFS and macOS APFS/HFS+, a request using different casing (e.g., /Admin/secret.lua) can evade these checks. Because the request path is later resolved against the filesystem, it allows unauthenticated remote attackers to read protected content or execute protected Lua scripts.

Recommendations Update to version 1.17.10.