6 matches found
CVE-2026-125751
Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...
CVE-2026-125751
Meteroid versions prior to 2.2.0 are vulnerable to a cross-tenant API token hash disclosure. The root cause is an authorization bypass in the ApiTokensService GetApiTokenById gRPC handler, which fails to enforce the caller's tenant context. Authenticated users possessing settings:read permissions...
EUVD-2026-121233
Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...
CVE-2026-125751 Meteroid before 2.2.0 Cross-Tenant API Token Hash Disclosure via GetApiTokenById
Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...
PT-2026-141747
Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...
CVE-2026-125751: meteroid-oss Meteroid: Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC…
Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...