CVE-2026-105140: Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.
Affected Software
Event History
Frequently Asked Questions
Which Obot deployments require remediation?
Deployments running Obot 0.25.0 through versions before 0.25.6, or 0.26.0 through versions before 0.26.1, are affected. Updating to 0.25.6 or 0.26.1 addresses the affected release lines.
What conditions are required for revoked access to persist?
A user's group membership must be revoked in the identity provider while overlapping auth-provider group refreshes for that same user commit out of order. The stale refresh can then persist the previously revoked membership.
How long can improperly retained group-based access last?
The user can retain revoked group-based access for about ten minutes.