{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fider--0.36.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-65840"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Fider (\u003c 0.36.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fider"],"content_html":"\u003cp\u003eFider, a feedback portal application, is vulnerable to an authentication bypass in versions prior to 0.36.0 when deployed in multi-tenant mode (HOST_MODE=multi). An attacker can utilize a valid email verification key issued by Tenant A to authenticate as that user on Tenant B. This failure in tenant isolation allows for unauthorized account takeover across the platform. Deployments configured for single-host mode (HOST_MODE=single) are not impacted by this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability enables unauthorized access to user accounts on different tenants. Given the CVSS v3.1 score of 9.6, this represents a critical risk to the confidentiality and integrity of multi-tenant environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Fider to version 0.36.0 or later immediately to apply the patch for CVE-2026-65840.\u003c/li\u003e\n\u003cli\u003eReview authentication and access logs for anomalous cross-tenant login patterns or unusual account verification behavior.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T20:08:11Z","date_published":"2026-11-11T20:08:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fider-auth-bypass-cve-2026-65840/","summary":"Fider versions prior to 0.36.0, when configured in multi-tenant mode, allow attackers to leverage an email verification key from one tenant to authenticate as that user on another, resulting in cross-tenant account takeover.","title":"Fider: Multi-tenant authentication bypass (CVE-2026-65840)","url":"https://feed.craftedsignal.io/briefs/2026-11-fider-auth-bypass-cve-2026-65840/"}],"language":"en","title":"CraftedSignal Threat Feed - Fider (\u003c 0.36.0)","version":"https://jsonfeed.org/version/1.1"}