CVE-2026-59185

identrail's GitHub App connection-completion endpoint binds a fully client-supplied "installationid" to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation...