Is CVE-2026-92801 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92801?

CVE-2026-92801 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-92801

Description

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.