CVE-2026-56767

Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/getmaxun/maxun/commit/11db0257531f1c23dec94727793c9444ee2873cf
https://github.com/getmaxun/maxun/issues/1079
https://github.com/getmaxun/maxun/pull/1088
https://www.vulncheck.com/advisories/maxun-cross-tenant-idor-in-storage-and-webhook-api-handlers

Configurations

No configuration.

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Maxun anterior a 0.0.42 contiene una vulnerabilidad de referencia directa a objetos insegura entre inquilinos en los manejadores de API de almacenamiento y webhook que permite a usuarios autenticados acceder a los robots y tokens OAuth de otros usuarios. Los atacantes pueden leer tokens de acceso de Google y Airtable en texto plano, modificar, eliminar o ejecutar los robots de otros usuarios eludiendo las comprobaciones de propiedad en los puntos finales de la API.

Information

Published : 2026-06-25 19:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-56767

Mitre link : CVE-2026-56767

CVE.ORG link : CVE-2026-56767

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-56767", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56767", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-25T20:27:10.895773Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/getmaxun/maxun", "vendor": "getmaxun", "product": "maxun", "versions": [{"status": "affected", "version": "0", "lessThan": "0.0.42", "versionType": "semver"}, {"status": "unaffected", "version": "0.0.42", "versionType": "semver"}], "packageURL": "pkg:github/getmaxun/maxun", "defaultStatus": "unaffected"}]}], "published": "2026-06-25T19:16:43.713", "references": [{"url": "https://github.com/getmaxun/maxun/commit/11db0257531f1c23dec94727793c9444ee2873cf", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/getmaxun/maxun/issues/1079", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/getmaxun/maxun/pull/1088", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/maxun-cross-tenant-idor-in-storage-and-webhook-api-handlers", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints."}, {"lang": "es", "value": "Maxun anterior a 0.0.42 contiene una vulnerabilidad de referencia directa a objetos insegura entre inquilinos en los manejadores de API de almacenamiento y webhook que permite a usuarios autenticados acceder a los robots y tokens OAuth de otros usuarios. Los atacantes pueden leer tokens de acceso de Google y Airtable en texto plano, modificar, eliminar o ejecutar los robots de otros usuarios eludiendo las comprobaciones de propiedad en los puntos finales de la API."}], "lastModified": "2026-10-25T22:10:00.150", "sourceIdentifier": "disclosure@vulncheck.com"}