{"affected":[{"product":"algernon","source":"CNA: GitHub_M","vendor":"xyproto","versions":[{"status":"affected","version":"< 1.17.10"}]}],"cveId":"CVE-2026-68548","cwes":["CWE-178","CWE-863"],"description":"Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.4,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1794512350279,"publishedAt":1794512350279,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/xyproto/algernon/releases/tag/v1.17.10"}],"remediation":[],"revision":"b6a9a3b88bb2477507e7811ac1c130d017cbb436ee29b019607f3841ca66d57b","sources":[{"modifiedAt":1794512350279,"name":"CNA: GitHub_M","retrievedAt":1794514309239,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68548"}],"ssvc":null,"status":"published","title":"Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gate","updatedAt":1794514309239}