Loading story…
Maxun versions earlier than 0.0.42 contain a high-severity cross-tenant insecure direct object reference (IDOR) flaw in storage and webhook API handlers that lets authenticated users bypass ownership checks and access resources belonging to other tenants. The vulnerability, tracked as CVE-2026-56767, affects multi-user deployments by breaking tenant isolation and exposing both confidentiality and integrity risks.
Successful exploitation can expose plaintext Google and Airtable OAuth access tokens and allow attackers to read, modify, delete, or execute other users’ robots remotely. Published advisories recommend upgrading to Maxun 0.0.42 or later and reviewing API activity for signs of unauthorized cross-tenant access or suspicious robot and webhook operations.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Remediation guidance advised users to upgrade Maxun to version 0.0.42 or later and audit API activity for suspicious behavior. This guidance was provided alongside the public disclosure of the vulnerability.
A high-severity cross-tenant insecure direct object reference vulnerability affecting Maxun versions before 0.0.42 was publicly disclosed. The issue impacts storage and webhook API handlers and can let authenticated attackers access other tenants' robots and plaintext Google and Airtable OAuth tokens.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MinIO disclosed two high-severity authentication vulnerabilities that could let attackers obtain unauthorized access to S3 data and administrative functions. **CVE-2026-33322** affects OpenID Connect authentication in versions from `RELEASE.2022-11-08T05-27-07Z` through versions before `RELEASE.2026-03-17T21-25-16Z`, where a JWT algorithm confusion issue allows an attacker who knows the OIDC `ClientSecret` to forge identity tokens and obtain S3 credentials with arbitrary policies, including `consoleAdmin`. The flaw creates a direct path to compromise confidentiality, integrity, and availability across affected MinIO deployments. A second issue, **CVE-2026-33419**, affects the STS `AssumeRoleWithLDAPIdentity` endpoint in MinIO AIStor before `RELEASE.2026-03-17T21-25-16Z`. Distinct error messages enabled LDAP username enumeration, and the absence of rate limiting allowed unlimited password-guessing attempts by an unauthenticated network attacker. If exploited, the weakness could yield temporary AWS-style STS credentials and expose S3 buckets and objects to unauthorized access. MinIO patched both vulnerabilities in `RELEASE.2026-03-17T21-25-16Z`.
Jun 29, 2026
Two high-severity vulnerabilities in **OneUptime** exposed unauthenticated endpoints that let remote attackers trigger sensitive actions without logging in. In versions before `10.0.42`, the Worker service's `GET` and `POST /workflow/manual/run/:workflowId` endpoints lacked authentication, allowing anyone who knew or guessed a workflow ID to execute workflows with attacker-controlled input. The issue could lead to JavaScript execution, notification abuse, and unauthorized data manipulation, and was tracked as **`CVE-2026-35053`** under **`CWE-306`**. A separate flaw, **`CVE-2026-34759`**, affected notification API endpoints exposed through the Nginx proxy at `/notification/` without the expected authorization middleware. Attackers could combine those endpoints with a `projectId` leak from the public Status Page API to abuse a victim's Twilio account, purchase phone numbers, delete existing alerting numbers, disrupt service, and expose SMTP credentials. Both vulnerabilities were disclosed through GitHub security advisories and patched in **OneUptime `10.0.42`**.
Jun 29, 2026
A critical broken object level authorization flaw tracked as **`CVE-2026-68582`** affects **Vikunja** versions **0.24.0 through 2.3.0**, allowing remote attackers with any project share link to access kanban bucket metadata from other tenants. The issue resides in the task-collection endpoint, where Vikunja loads a project view from the URL path without confirming the caller is authorized for that view. Exposed data can include bucket titles and full `created_by` user objects containing username, name, and ID. The same authorization weakness also creates a project and view ID existence oracle, as attackers can distinguish valid from invalid resources through **404 versus non-404** responses using either link-share access or ordinary authenticated accounts. Reports note that task contents remain restricted to the shared project and are not disclosed through this bug. The vulnerability is remotely exploitable and has been fixed in **Vikunja 2.4.0**.
Aug 2, 2026