Loading story…
A multi-tenant social media monitoring and PR SaaS platform exposed customer documents across organizations through a path traversal flaw in its file download workflow. Researchers found that an authenticated user could manipulate the folderPath parameter in the /api/clientpublicdoc endpoint, causing the public API to rewrite an internal request to the platform’s document management service and return data from other tenants’ asset-library directories. The weakness effectively became a Broken Object Level Authorization issue by allowing access to objects belonging to other customers without proper authorization checks.
The researchers reported that tenant directory names could be derived from the sourceKey field returned by /api/clientpublicdoc/list, and those names were predictable because they embedded sequential client IDs. By substituting another tenant’s sourceKey, an attacker could enumerate files belonging to other organizations and obtain direct CDN publicUrl links that required no authentication, exposing filenames, metadata, marketing assets, brochures, and internal documents. The case highlights how path traversal in APIs can extend beyond filesystem access and directly undermine tenant boundary enforcement in shared SaaS environments.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Cognisys Group Labs published research describing a vulnerability in a multi-tenant social media monitoring and PR platform where manipulating the folderPath parameter in /api/clientpublicdoc let an authenticated tenant enumerate and access other tenants’ Asset Library contents via an internal DMS API. The write-up states the issue exposed filenames, metadata, and direct CDN download links for other organizations’ files, breaking tenant isolation.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
labs.cognisys.group
Open sourceportswigger.net
Open sourceowasp.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two path traversal vulnerabilities, **`CVE-2026-3864`** in the Kubernetes **NFS CSI driver** and **`CVE-2026-3865`** in the **SMB CSI driver**, allow attackers with **`persistentvolumes:create`** permission to escape intended subdirectory boundaries and access other tenants’ data on shared exports. The flaws stem from the drivers trusting attacker-controlled `subDir` values embedded in `PersistentVolume.volumeHandle` fields and relying on Go path handling in ways that did not enforce containment, enabling unauthorized read, write, modification, and deletion of files across shared NFS or SMB storage. Researchers said the issue reflects a broader trust-boundary failure in Kubernetes environments, where requests that are authenticated and authorized by the API are not necessarily safe for privileged components to execute. In some NFS deployments with broader `hostPath` exposure, the bugs could also lead to arbitrary directory deletion on worker nodes. Fixes were released in **NFS CSI Driver `v4.13.1`** and **SMB CSI Driver `v1.20.1`**, while defenders were urged to restrict PersistentVolume creation, tighten RBAC and GitOps service accounts, use admission controls to validate storage parameters, and review similar path-handling patterns across other CSI drivers and cloud-native components.
Jul 24, 2026
OWASP's **API Security Top 10** identifies broken object-level and function-level authorization, excessive data exposure, security misconfiguration, and unsafe trust boundaries as leading API risks, warning that business logic abuse and operational gaps often turn ordinary endpoints into high-impact exposures. Those patterns were reflected in newly disclosed incidents involving both enterprise software and consumer-facing platforms, where low-privileged access was enough to reach data and functions intended for administrators or other users. In **CVE-2026-46515**, Frogman versions before `1.6.3` allowed users with only `PERM_READ` privileges to access administrative PBX data through MCP and HTTP APIs, including AMI manager secrets, outbound dial PINs, SIP secrets, backup paths, CDR history, and even root SSH connection commands; the flaw also enabled arbitrary execution of saved GraphQL queries and was rated **CVSS 9.3**. Separately, a bug bounty report on Target's Academy platform showed how two seemingly low-risk APIs could be chained to enumerate users and expose PII at scale, underscoring how weak authorization controls across interconnected endpoints can escalate routine API functionality into serious data disclosure.
Jul 19, 2026
Security researchers uncovered significant vulnerabilities in web applications due to broken access control mechanisms, leading to unauthorized privilege escalation and potential system compromise. In one case, a researcher discovered that a SaaS platform inadvertently exposed administrative functionalities to regular users. By simply signing up for a free trial, the user noticed an admin panel link was visible, which should not have been accessible to non-privileged accounts. Initial attempts to access the admin panel resulted in a 403 Forbidden error, but further probing revealed that the access control checks were insufficiently enforced. Through a series of advanced techniques, the researcher was able to escalate privileges, ultimately gaining access to sensitive administrative features and potentially compromising the entire system. This highlights the critical risk posed by misconfigured or broken permission models in enterprise SaaS environments, where a single oversight can grant attackers broad access to internal resources. In a separate incident, a security tester examining a hospital website identified two PHP endpoints protected by 403 Forbidden responses. Despite the initial access denial, the tester experimented with different HTTP methods and payloads, eventually bypassing the restriction by switching from a GET to a POST request and supplying the required form data. The server processed the request as if it were legitimate, exposing a workflow flaw that could allow unauthorized users to submit sensitive information or interact with backend systems. The tester replicated this technique on another endpoint, confirming that the access control logic was consistently weak across multiple parts of the application. Both incidents underscore the prevalence of insecure direct object references and improper authorization checks in modern web applications. Attackers can exploit these weaknesses to move laterally within systems, access confidential data, or disrupt critical workflows. The findings demonstrate the importance of rigorous access control validation, including proper segregation of user roles and comprehensive testing of all endpoints for privilege escalation vectors. Organizations are urged to review their authentication and authorization mechanisms, implement least privilege principles, and conduct regular security assessments to identify and remediate such vulnerabilities before they can be exploited. These real-world examples serve as a cautionary tale for developers and security teams, emphasizing that even seemingly minor oversights in access control can have far-reaching consequences for data security and operational integrity.
Jul 12, 2026