Fider (< 0.36.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fider--0.36.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 20:08:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFider: Multi-tenant authentication bypass (CVE-2026-65840)https://feed.craftedsignal.io/briefs/2026-11-fider-auth-bypass-cve-2026-65840/Wed, 11 Nov 2026 20:08:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fider-auth-bypass-cve-2026-65840/Fider versions prior to 0.36.0, when configured in multi-tenant mode, allow attackers to leverage an email verification key from one tenant to authenticate as that user on another, resulting in cross-tenant account takeover.Fider, a feedback portal application, is vulnerable to an authentication bypass in versions prior to 0.36.0 when deployed in multi-tenant mode (HOST_MODE=multi). An attacker can utilize a valid email verification key issued by Tenant A to authenticate as that user on Tenant B. This failure in tenant isolation allows for unauthorized account takeover across the platform. Deployments configured for single-host mode (HOST_MODE=single) are not impacted by this vulnerability.

Impact

The vulnerability enables unauthorized access to user accounts on different tenants. Given the CVSS v3.1 score of 9.6, this represents a critical risk to the confidentiality and integrity of multi-tenant environments.

Recommendation

  • Update Fider to version 0.36.0 or later immediately to apply the patch for CVE-2026-65840.
  • Review authentication and access logs for anomalous cross-tenant login patterns or unusual account verification behavior.
]]>criticaladvisory