Malcolm's Nginx Lua-based RBAC layer evaluated the unnormalized request URI while Nginx routed on the normalized path. An authenticated low-privilege user could prepend traversal segments (for example /x/../upload/...) to bypass access restrictions and reach protected backends. Fixed in Malcolm 26.07.0.
Authorization bypass via a URI-normalization differential in the RBAC layer.