CVE-2026-4171 | CodeGenieApp serverless-express up to 4.17.1 API Endpoint TodoList.ts userId authorization

A vulnerability classified as critical has been found in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file examples/lambda-function-url/packages/api/models/TodoList.ts of the component API Endpoint. The manipulation of the argument userId leads to authorization bypass.

This vulnerability is uniquely identified as CVE-2026-4171. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.