Skip to content
Threat Feed
Subscribe

Product

Convoy (<= 26.6.2)

1 brief RSS
high advisory

Cross-Tenant IDOR in Convoy API Exposes Broker Credentials

Convoy versions up to and including 26.6.2 contain an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to leak plaintext message broker credentials from other tenants.

convoy idor credential-leak api-security
2t 1c