Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

Summary frain-dev/convoy all versions up to and including v26.6.2, no patch available lets any authenticated caller who is authorized on at least one project read ANY OTHER project's "Source" record by ID via GET /api/v1/projects/projectID/sources/sourceID -- regardless of whether that Source...

CVE-2026-81505

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...

CVE-2026-81505

Convoy , a cloud-native webhooks gateway, is affected by a cross-tenant IDOR in the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint. The handler authorizes the project in the URL but sources.Service.FindSourceByID() fetches the source solely by sourceID without verifying that its Pro...

CVE-2026-81505 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...

EUVD-2026-83051

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...