GHSA-chx7-hm9p-hcvgMediumCVSS 4.3
OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's...
🔗 CVE IDs covered (1)
📋 Description
OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries.
🔗 References (10)
- https://nvd.nist.gov/vuln/detail/CVE-2026-92764
- https://github.com/opencve/opencve/issues/744
- https://github.com/opencve/opencve
- https://github.com/opencve/opencve/blob/v2.4.0/web/organizations/resources.py#L20-L25
- https://github.com/opencve/opencve/blob/v3.1.0/web/organizations/resources.py#L20-L30
- https://github.com/opencve/opencve/releases/tag/v3.1.0
- https://www.vulncheck.com/advisories/opencve-before-3.1.0-organization-api-ignores-token-scope
- https://github.com/opencve/opencve/security/advisories/GHSA-xvpw-4gpp-w7h7
- https://www.vulncheck.com/advisories/opencve-organization-api-ignores-token-scope
- https://github.com/advisories/GHSA-chx7-hm9p-hcvg