Cpe:2.3:a:rilldata:rill:0.77.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3arilldatarill0.77.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 11 Oct 2026 14:01:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMissing Authorization Vulnerability in Rill Admin OAuth Serverhttps://feed.craftedsignal.io/briefs/2026-10-rill-oauth-vuln/Sun, 11 Oct 2026 14:01:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-rill-oauth-vuln/Rill versions 0.77.0 through 0.90.5 contain a missing authorization vulnerability that allows attackers to obtain non-expiring API tokens with elevated permissions via unauthorized OAuth code issuance.Rill versions 0.77.0 through 0.90.5 are affected by a missing authorization vulnerability within the admin OAuth server component. This flaw permits the dynamic registration of OAuth clients that can request elevated scopes, such as long_lived_access_token, without obtaining explicit user consent. An attacker can exploit this by registering a malicious client and tricking a legitimate user into visiting a crafted authorization link. Upon the user's interaction, the system issues a non-expiring API token directly to the attacker-controlled client, granting the attacker the user's full permissions. This vulnerability enables persistent access and potential exfiltration of sensitive analytics or metadata managed within the Rill environment. Organizations utilizing Rill versions 0.77.0 to 0.90.5 are at risk of complete account takeover if users interact with attacker-supplied authorization links.

Impact

Successful exploitation results in the unauthorized generation of non-expiring API tokens, granting attackers persistent access to user data and Rill platform resources. This can lead to significant data exfiltration, unauthorized modification of analytics configurations, and loss of environment control. The severity is highlighted by a CVSS v3.1 base score of 8.1, reflecting high potential for unauthorized access and privilege escalation.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

  • Upgrade all instances of Rill to a version beyond 0.90.5 immediately to patch CVE-2026-108718.
  • Audit OAuth client registrations in Rill administrative logs for any unexpected or dynamically registered client IDs initiated during the period of exposure.
  • Review logs for OAuth authorization requests where the requested scope includes long_lived_access_token and the client was not pre-approved or vetted by administrative policy.
  • Implement stricter access control policies for dynamic client registration to prevent unauthorized third-party integrations.
]]>highadvisory