critical advisory November 11, 2026

Fider: Multi-tenant authentication bypass (CVE-2026-65840)

Fider versions prior to 0.36.0, when configured in multi-tenant mode, allow attackers to leverage an email verification key from one tenant to authenticate as that user on another, resulting in cross-tenant account takeover.

Triage facts

Revision 1

Applicability: Fider (< 0.36.0)
Evidence: Unknown
Severity: Critical
Action: Immediate escalation
Sources: 1 public source
Freshness: Revision 1Nov 11, 20:08 UTC
Vulnerabilities: 1 CVE
Source quality: A1Likely

Fider, a feedback portal application, is vulnerable to an authentication bypass in versions prior to 0.36.0 when deployed in multi-tenant mode (HOST_MODE=multi). An attacker can utilize a valid email verification key issued by Tenant A to authenticate as that user on Tenant B. This failure in tenant isolation allows for unauthorized account takeover across the platform. Deployments configured for single-host mode (HOST_MODE=single) are not impacted by this vulnerability.

Impact

The vulnerability enables unauthorized access to user accounts on different tenants. Given the CVSS v3.1 score of 9.6, this represents a critical risk to the confidentiality and integrity of multi-tenant environments.

Recommendation

Update Fider to version 0.36.0 or later immediately to apply the patch for CVE-2026-65840.
Review authentication and access logs for anomalous cross-tenant login patterns or unusual account verification behavior.

Immediate actions

Upgrade Fider to version 0.36.0 or later to patch CVE-2026-65840.

IT Operations 24h

Threat Hunt

Identify irregular authentication patterns where an account verification key is reused or accepted across different tenant identifiers.

T1199 high medium confidence hunt now

Data: Application access logs, Authentication service logs

Mitigations

Upgrade to Fider 0.36.0 or later.

immediate IT Operations

CVE-2026-65840