CVE-2026-65840: Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey
Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOSTMODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOSTMODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fiderto a version that resolves this vulnerability.Fixed in 0.36.0
Event History
Frequently Asked Questions
Which deployments are affected?
Only Fider deployments configured for multi-tenant operation with HOST_MODE=multi are affected before version 0.36.0. Single-host deployments using HOST_MODE=single, which is the default, are not affected.
What does an attacker need to exploit this issue?
The attacker needs an email verification key issued by one tenant and must target another tenant where the same email address is used. The flaw allows that key to authenticate the attacker as that email address in the other tenant.
What is the impact in a multi-tenant environment?
The issue bypasses tenant isolation and can result in unauthorized account takeover across tenants. An attacker can authenticate to Tenant B using a verification key issued by Tenant A for the same email address.
How should affected deployments be remediated?
Upgrade Fider to version 0.36.0, which includes the patch. If an immediate upgrade is not possible, the provided information does not identify a mitigation other than avoiding multi-tenant mode.