Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installationid to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installati...

GHSA-CP3J-M783-3PH5 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installationid to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installati...