Skip to content
Threat Feed

Tag

Cross-Tenant

2 briefs RSS
critical advisory

Paperclip Cross-Tenant Agent API Token Minting Vulnerability

A vulnerability in Paperclip allows any authenticated user to mint agent API tokens for other tenants, leading to unauthorized access and control due to missing company access checks.

paperclip broken-access-control cross-tenant
2r 3t
critical advisory

Paperclip Cross-Tenant Agent API Key IDOR Vulnerability

A Paperclip API vulnerability allows a board user from one company to create, list, and revoke agent API keys in another company, leading to full cross-tenant compromise due to insufficient authorization checks on `/agents/:id/keys` routes.

idor cross-tenant api paperclip privilege-escalation
3r 5t