Skip to content
Threat Feed
Subscribe

Tag

Multi-Tenancy

4 briefs RSS
critical advisory

obsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363)

The obsidian-tc package HTTP transport lacks Origin header validation and DNS-rebinding protection, allowing drive-by vault access via loopback.

obsidian-tc +1 auth-bypass multi-tenancy web-application npm vulnerability file-overwrite data-corruption
3c
high advisory

Insufficient Validation in Coze Studio Workflow SQL Nodes

Coze Studio versions up to 0.5.1 contain an input validation vulnerability in workflow SQL customization nodes allowing authenticated attackers to bypass workspace isolation and execute unauthorized SQL queries.

Coze Studio web-vulnerability sql-injection multi-tenancy cve-2026-92788
1t 1c
high advisory

SuperPlane Broken Object-Level Authorization Vulnerability (CVE-2026-57510)

A critical broken object-level authorization vulnerability in SuperPlane's CanvasService gRPC handlers, tracked as CVE-2026-57510, allows authenticated users with viewer-level access to bypass organization scoping and access resources across tenant boundaries, leading to data collection and system impact.

SuperPlane < 0.27.0 authorization-bypass api-security saas cloud multi-tenancy grpc cve
3t 1c
critical advisory

AxonFlow Platform Multi-Tenant Isolation and Access Control Vulnerabilities

Multiple vulnerabilities in AxonFlow platform versions prior to 7.5.0, including multi-tenant isolation issues and SQL injection, could lead to unauthorized access, information disclosure, denial of service, and other security impacts; AxonFlow v7.5.0 resolves these issues.

axonflow platform +2 multi-tenancy access-control SQL injection denial of service vulnerability
2r 5t