getmaxun up to 0.0.41 API authorization

Summaryinfo

A vulnerability described as critical has been identified in getmaxun maxun up to 0.0.41. This affects an unknown function of the component API Handler. Executing a manipulation can lead to authorization. This vulnerability appears as CVE-2026-56767. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in getmaxun maxun up to 0.0.41 and classified as critical. This vulnerability affects an unknown code block of the component API Handler. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints.

The weakness was presented by George Chen as 1079. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-56767 since 06/22/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.0.42 eliminates this vulnerability. Applying the patch 11db0257531f1c23dec94727793c9444ee2873cf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• getmaxun

Name

• maxun

Version

• 0.0.1
• 0.0.2
• 0.0.3
• 0.0.4
• 0.0.5
• 0.0.6
• 0.0.7
• 0.0.8
• 0.0.9
• 0.0.10
• 0.0.11
• 0.0.12
• 0.0.13
• 0.0.14
• 0.0.15
• 0.0.16
• 0.0.17
• 0.0.18
• 0.0.19
• 0.0.20
• 0.0.21
• 0.0.22
• 0.0.23
• 0.0.24
• 0.0.25
• 0.0.26
• 0.0.27
• 0.0.28
• 0.0.29
• 0.0.30
• 0.0.31
• 0.0.32
• 0.0.33
• 0.0.34
• 0.0.35
• 0.0.36
• 0.0.37
• 0.0.38
• 0.0.39
• 0.0.40
• 0.0.41

License

• open-source

Website

• Product: https://github.com/getmaxun/maxun/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion