Cpe:2.3:a:shuffle:shuffle_through:2.2.1:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ashuffleshuffle_through2.2.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 19:51:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCross-Tenant Privilege Escalation in Shufflehttps://feed.craftedsignal.io/briefs/2026-09-shuffle-privilege-escalation/Wed, 16 Sep 2026 19:51:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-shuffle-privilege-escalation/Shuffle through version 2.2.1 is vulnerable to a cross-tenant privilege escalation flaw in the HandleApiGeneration endpoint that allows an authenticated administrator to reset and steal API keys from other tenants.Shuffle through version 2.2.1 contains a severe security vulnerability (CVE-2026-92716) that facilitates cross-tenant privilege escalation. The vulnerability resides within the HandleApiGeneration endpoint. An attacker who has already obtained administrator privileges within one Shuffle tenant can leverage this endpoint to perform unauthorized actions against other organizations using the platform. Specifically, by supplying arbitrary user IDs to the vulnerable endpoint, an administrator can trigger a reset of API keys for users belonging to different organizations. The endpoint then returns the generated keys to the attacker, effectively granting them full programmatic access to the victim's account across tenant boundaries. This flaw represents a critical security risk for multi-tenant environments where the isolation of administrative control is expected.

Impact

The exploitation of this vulnerability allows for complete cross-tenant account takeover. An attacker can access sensitive data, modify workflow configurations, and perform unauthorized actions within the victim's organization, bypassing the intended logical isolation between tenants.

Recommendation

Prioritize the investigation of administrative account logs to identify any requests to the HandleApiGeneration endpoint referencing User IDs belonging to different organization identifiers. If available, restrict access to administrative API endpoints via network-level controls or WAF rules to known trusted administrative IP addresses. Immediately upgrade all Shuffle through instances to a patched version once released by the vendor to eliminate the underlying logic flaw.

]]>criticaladvisory