CVE-2026-119663 in Tamery
Summary
by MITRE • 10/30/2026
Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Tamery, formerly known as Conar, specifically within versions ranging from 0.32.0 up to but not including 0.99.0, represents a critical failure in access control mechanisms governing cloud synchronization operations. This flaw is located within the connectionsResources.create handler of the application's API architecture. The core issue stems from insufficient validation of resource ownership during batch processing requests. In modern web applications that facilitate multi-tenant environments or user-specific data silos, it is imperative that every operation strictly verifies that the authenticated actor possesses explicit authorization for both the target container and the resources being manipulated within it. Here, the system fails to enforce this boundary correctly when handling bulk insertions of resource rows.
From a technical perspective, the vulnerability exploits the batch request functionality which allows clients to submit multiple operations in a single HTTP call. The application logic accepts connection identifiers provided by the client without adequately cross-referencing them against the authenticated user's permitted scope. Consequently, an attacker who has valid credentials for one specific connection can manipulate the payload of a batch request to include a victim's unique connectionId. By doing so, the server processes these instructions as if they originated from within the context of that victim's authorized session or workspace. This allows the insertion of resource rows labeled with names defined by the attacker but stored under the victim's account structure.
The operational impact of this vulnerability is significant because it enables unauthorized data injection and potential information disclosure depending on how those resources are subsequently rendered or accessed. An adversary can pollute a victim's dataset with maliciously named entries, which could lead to confusion in user interfaces, corruption of analytics if such data is aggregated, or serve as a vector for further attacks such as cross-site scripting if the resource names are reflected without proper sanitization elsewhere in the application. Furthermore, this behavior violates the fundamental principle of least privilege and isolation between users, undermining trust in the platform's ability to protect user-specific assets.
This flaw aligns with CWE-269, which describes Improper Privilege Control, as it involves an actor gaining capabilities beyond their intended permissions through manipulation of input parameters rather than direct elevation of privileges via system exploits. Additionally, this behavior is consistent with ATT&CK technique T1078, Valid Accounts, where the attacker leverages legitimate credentials to perform unauthorized actions within a trusted context. The specific mechanism of manipulating object references in batch operations also reflects aspects of CWE-639, Authorization Bypass Through User-Controlled Key, although it manifests through API logic rather than simple key guessing.
To mitigate this vulnerability, developers must implement strict server-side validation for all resource creation requests, particularly those involving batch processing. The application should verify that the connectionId referenced in any request payload belongs to the authenticated user making the request or is explicitly shared with them by an administrator. Input sanitization and ownership checks must be applied before any database write operations occur. Upgrading to version 0.99.0 or later resolves this issue as it includes patches for these authorization controls. Until such updates are deployed, organizations should consider implementing reverse proxies that inspect API payloads for anomalous connectionId patterns associated with the authenticated user's profile and block requests where there is a mismatch between the session context and the target resource identifiers.