CVE-2026-75480 in OpenViking
Summary
by MITRE • 08/18/2026
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified within OpenViking represents a critical failure in multi-tenancy isolation mechanisms, specifically affecting the debug vector scroll and count endpoints. This flaw stems from an insufficient authorization check that relies exclusively on account-level scoping rather than implementing granular user-level access controls. In secure software architecture, particularly for applications handling sensitive data such as private memories or secret materials, it is imperative to enforce both tenant isolation and individual identity verification at every request processing stage. By omitting the validation of the specific requesting user against the resource owner, the system inadvertently exposes a path where any authenticated member of an account can access data belonging to their peers. This architectural oversight violates fundamental principles of least privilege and separation of duties, creating a significant security gap that undermines the confidentiality guarantees expected in multi-user environments.
From a technical perspective, the exploitability of this vulnerability is straightforward for any attacker who has obtained valid authentication credentials within the affected account. Once authenticated, an adversary can interact with the scroll and count endpoints to enumerate and retrieve records associated with other users. The scope of accessible data includes private memories, user resources, skills, and secret material, all of which are intended to be restricted to their respective owners or authorized administrators only. Because these endpoints lack proper validation logic that maps the request context to a specific user identity rather than just an account identifier, the application serves as a conduit for unauthorized data exfiltration. This type of flaw is characteristic of broken object level authorization issues where the system trusts the client-side provided identifiers without verifying them against server-side access control policies.
The operational impact of this vulnerability is severe due to the sensitivity of the exposed information types. Private memories and secret materials often contain personal identifiable information, credentials, or proprietary business logic that could lead to further compromise if leaked. An attacker can use these endpoints not only for direct data theft but also as a reconnaissance tool to map out user activities, identify high-value targets within the account, and gather intelligence for subsequent attacks such as social engineering or credential stuffing. The ability to read all co-tenant records without administrative privileges means that even low-level users pose a significant risk to the overall security posture of the organization using OpenViking. This erosion of trust in data isolation can lead to regulatory non-compliance with standards like GDPR or HIPAA, which mandate strict controls over personal and sensitive data access.
This vulnerability aligns closely with CWE-639, Authorization Bypass Through User-Controlled Key, as it involves the failure to enforce proper authorization checks on a key parameter that determines resource ownership. Furthermore, in terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1078, Valid Accounts, where an attacker leverages legitimate credentials to access resources they are not authorized to view. It also reflects aspects of T1530, Data from Local System Extraction, when considering the lateral movement potential within a compromised account context. To mitigate this risk, developers must implement robust authorization middleware that validates both tenant and user identity for every request directed at sensitive endpoints. This includes ensuring that database queries explicitly filter by the authenticated user's unique identifier in addition to the account ID. Regular security audits focusing on access control logic and automated testing using tools designed to detect broken object level authorization flaws are essential steps toward resolving this issue and restoring confidence in the platform's data isolation capabilities.