35 matches found
GO-2026-6523 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy...
CVE-2026-81505
creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:07+00:00| published-proof-of-concept| https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4 2026-09-19 10:31:27+00:00| seen| https://gist.github.com/alon710/9fb1086f5e4e9b47992fc238d03c86ef...
GHSA-P5VG-V7MJ-F6Q4 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
Summary frain-dev/convoy all versions up to and including v26.6.2, no patch available lets any authenticated caller who is authorized on at least one project read ANY OTHER project's "Source" record by ID via GET /api/v1/projects/projectID/sources/sourceID -- regardless of whether that Source...
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
Summary frain-dev/convoy all versions up to and including v26.6.2, no patch available lets any authenticated caller who is authorized on at least one project read ANY OTHER project's "Source" record by ID via GET /api/v1/projects/projectID/sources/sourceID -- regardless of whether that Source...
CVE-2026-81505
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...
EUVD-2026-83051
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...
CVE-2026-81505 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...
CVE-2026-81505
Convoy , a cloud-native webhooks gateway, is affected by a cross-tenant IDOR in the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint. The handler authorizes the project in the URL but sources.Service.FindSourceByID() fetches the source solely by sourceID without verifying that its Pro...
CVE-2026-81505 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...
CVE-2026-81505
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...
CVE-2026-81505 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...
CVE-2026-81505: Authorization Bypass Through User-Controlled Key
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...
PT-2026-95501
Name of the Vulnerable Software and Affected Versions Convoy versions prior to 26.6.8 Description An issue exists in the GET /api/v1/projects/projectID/sources/sourceID endpoint where the system authorizes access to the project specified in the URL but fails to verify if the requested source...
CVE-2026-33746
Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated...
CVE-2026-33746
Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated...
CVE-2026-33746 Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users
Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated...
CVE-2026-33746
Convoy (KVM server management panel) is vulnerable in versions 3.9.0-beta through
CVE-2026-33746
Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated...
CVE-2026-33746 Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users
Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated...
CVE-2026-33746
Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated...