{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/swetrix/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:swetrix:swetrix_cloud:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-110621"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Swetrix Cloud (\u003c 5.1.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Swetrix"],"content_html":"\u003cp\u003eSwetrix Cloud versions prior to 5.1.0 are affected by a missing authorization vulnerability within the ProjectController.addProject endpoint. This flaw allows any authenticated user to hijack arbitrary projects by moving them into their own organization. By leveraging the project's public tracking ID, an attacker can manipulate project ownership, granting them unauthorized access to sensitive analytics, modification of project configuration settings, or the ability to perform a permanent deletion of the victim project. This vulnerability represents a significant risk to data integrity and availability for users of the Swetrix platform, as it permits unauthorized cross-tenant resource manipulation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized users to gain full administrative or read-only control over projects belonging to other organizations. This results in the potential exposure of private analytics data and enables destructive actions such as the deletion of victim projects, directly impacting the confidentiality and availability of customer data stored within the Swetrix Cloud environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Swetrix Cloud to version 5.1.0 or later immediately to address the missing authorization vulnerability in ProjectController.\u003c/li\u003e\n\u003cli\u003eAudit project ownership logs within the Swetrix platform to identify any unauthorized transfers or unexpected changes in project association that may have occurred prior to patching.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:36:55Z","date_published":"2026-10-14T16:36:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-swetrix-auth-bypass/","summary":"Swetrix Cloud versions before 5.1.0 contain a missing authorization vulnerability in the ProjectController component that allows authenticated attackers to hijack arbitrary projects.","title":"Missing Authorization Vulnerability in Swetrix Cloud","url":"https://feed.craftedsignal.io/briefs/2026-10-swetrix-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Swetrix","version":"https://jsonfeed.org/version/1.1"}