CVE-2026-92764 in OpenCVE
Summary
by MITRE • 09/16/2026
OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in OpenCVE versions prior to 3.1.0 represents a critical failure in access control logic within the application’s API layer. Specifically, the organizations endpoint does not correctly enforce scoping based on the organization associated with the authentication token presented by the client. Instead of restricting data retrieval to only those resources belonging to the specific organization linked to the active session or token, the backend implementation erroneously returns a list containing all organizational memberships held by the user who originally created the API token. This architectural flaw undermines the fundamental principle of least privilege and breaks the isolation boundaries that are essential for multi-tenant environments where distinct organizations must maintain strict data separation.
From a technical perspective, this issue stems from improper validation of tenant context during request processing. When an authenticated request is received, the system should extract the organization identifier from the token’s claims or session metadata and use it to filter database queries against organizational records. However, in affected versions, the query logic ignores the current user's immediate scope and instead traverses the creator’s broader association graph. This allows any individual possessing a valid API key generated by an administrator or privileged member of one organization to enumerate all other organizations that same administrator is affiliated with. The flaw effectively transforms what should be a narrow, scoped access mechanism into a broad enumeration tool for organizational metadata.
The operational impact of this vulnerability is significant in terms of information disclosure and potential lateral movement within compromised environments. Attackers who obtain or forge an API token can leverage the exposed endpoint to map out the entire ecosystem of organizations connected to the token creator. This intelligence gathering phase provides attackers with valuable context, including potentially sensitive organizational names, identifiers, and structural relationships that are not intended for public or cross-tenant visibility. Such information can facilitate further targeted attacks, such as social engineering campaigns against specific entities within those revealed organizations or attempts to exploit related vulnerabilities in other connected systems where the same credentials might be reused.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in enforcing scope and isolation between different user contexts. Furthermore, it maps directly to MITRE ATT&CK technique T1087, Account Discovery, as well as sub-technique T1087.001, Local Account Discovery, when considering the enumeration of organizational accounts. The ability to list organizations constitutes a reconnaissance activity that lowers the barrier for subsequent exploitation phases by providing attackers with a clear map of high-value targets within the platform’s ecosystem.
Mitigation strategies must prioritize immediate patching and strict access control enforcement. Organizations running OpenCVE versions earlier than 3.1.0 should upgrade to the latest stable release where this scoping logic has been corrected. In addition to upgrading, administrators should audit existing API tokens for those created by users with broad organizational memberships and rotate them if possible. Implementing additional monitoring on the organizations endpoint can help detect anomalous enumeration patterns indicative of exploitation attempts. Future development cycles must incorporate rigorous unit testing that validates token-scoped isolation across all multi-tenant endpoints to ensure that access control checks are consistently applied against the correct tenant context rather than relying on implicit user associations.