CVE-2026-119663: Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create
Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.
Event History
Frequently Asked Questions
Which deployments are affected?
Tamery versions from 0.32.0 up to, but not including, 0.99.0 are affected. The issue is in the cloud sync API's connectionsResources.create handler.
What does an attacker need to exploit this?
The attacker must be authenticated and must own at least one connection. They can submit a batch request containing another user's connectionId.
What is the impact on another user's connection?
An attacker can insert resource rows with attacker-chosen names into the victim connection's resource list. The provided information indicates integrity impact only; it does not describe confidentiality or availability impact.
How can administrators look for possible exploitation?
Review cloud sync batch requests and resource-row creation records for cases where the authenticated user owns one connection but supplies a connectionId belonging to another user. Attacker-named resource rows appearing in a victim's client resource list are an indicator.