Authentication Bypass Using an Alternate Path or Channel Affecting github.com/go-chi/chi/v5/middleware package, versions <5.5.0

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the SupressNotFound middleware in middleware/supress_notfound.go. An unauthenticated attacker can send a request to a mounted path whose suffix also matches a public root route; the preflight match mutates the live route context, so the root handler runs with the retained tenant parameter and skips the mounted router’s authentication middleware, exposing tenant-scoped data if that handler trusts the parameter and does not enforce authorization itself. Without a colliding root route, the same context mutation can instead cause a valid request to a mounted child route to return 404.

Workarounds

• Remove middleware.SupressNotFound from the outer router to prevent its preflight match from misrouting mounted requests.
• Enforce authorization in a common ancestor or in the handler itself, so a request routed to an outer public handler cannot access tenant-scoped data without authorization.

• GitHub Commit v5.5.0
• Maintainer's Advisory