CVE-2026-125752: Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus

Published Nov 10, 2026

Updated

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Meteroid to a version that resolves this vulnerability.
Fixed in 2.2.0

Event History

Nov 10, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated and have either the catalog:manage permission or a tenant-scoped API key. They also need to know or obtain the ID of a coupon belonging to another tenant.

What impact can exploitation have?

The attacker can change the status of another tenant's coupon, including disabling, archiving, or re-enabling it. The affected handler also returns the other tenant's coupon details.

Which deployments are affected?

Meteroid versions before 2.2.0 are affected where the CouponsService UpdateCouponStatus gRPC handler is available to users or API keys with the required authorization.

How can I determine whether an instance is vulnerable?

Check the deployed Meteroid version and upgrade status: versions before 2.2.0 are affected. Review UpdateCouponStatus activity for requests made by one tenant that reference coupon IDs owned by another tenant.

CVE-2026-125752: Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can exploitation have?

Which deployments are affected?

How can I determine whether an instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can exploitation have?

Which deployments are affected?

How can I determine whether an instance is vulnerable?