CVE-2026-92764

Summary

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries.

Affected Software

Weaknesses

• CWE-863: Incorrect Authorization

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/opencve/opencve/issues/744
• https://github.com/opencve/opencve/releases/tag/v3.1.0
• https://github.com/opencve/opencve/security/advisories/GHSA-xvpw-4gpp-w7h7
• https://www.vulncheck.com/advisories/opencve-organization-api-ignores-token-scope

• ←Previous
• Next→