CVE-2026-125751

Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...

CVE-2026-125752

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant'...

CVE-2026-125751

Meteroid versions prior to 2.2.0 are vulnerable to a cross-tenant API token hash disclosure. The root cause is an authorization bypass in the ApiTokensService GetApiTokenById gRPC handler, which fails to enforce the caller's tenant context. Authenticated users possessing settings:read permissions...

EUVD-2026-121234

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant'...

EUVD-2026-121233

Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...

CVE-2026-125751 Meteroid before 2.2.0 Cross-Tenant API Token Hash Disclosure via GetApiTokenById

Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...

CVE-2026-125752 Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant'...

CVE-2026-125752

Meteroid versions prior to 2.2.0 are vulnerable to a cross-tenant authorization bypass within the CouponsService UpdateCouponStatus gRPC handler. The underlying cause is that the UPDATE query filters exclusively on the coupon id while failing to validate the tenant ID . This allows authenticated ...

PT-2026-141747

Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...

CVE-2026-125752: meteroid-oss Meteroid: Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService…

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant'...

CVE-2026-125751: meteroid-oss Meteroid: Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC…

Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...

PT-2026-141748

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant'...