CVE-2026-80209: Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues into prisma.workspace.update, which is scoped by the workspace reference alone, so the rename commits before the second callback is issued and the caller receives a permission error for a write that already succeeded. The gRPC interceptor in mods/common/src/identity/createAuthInterceptor.ts binds the workspace accessKeyId to the caller's token only for paths in workspaceResourceAccess or workspaceResourceOwnerOrAdminAccess, and Identity/UpdateWorkspace is listed in fullIdentityAccess, which the base USER role holds. Any authenticated user can therefore rename an arbitrary workspace in the deployment.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user holding the base USER role can exploit it. The vulnerable Identity/UpdateWorkspace path is included in fullIdentityAccess, so access is not bound to membership in the workspace being renamed.
What access does an attacker need?
The attacker needs valid authentication and the ability to invoke the Identity/UpdateWorkspace gRPC handler. No workspace membership in the target workspace is required.
What is the practical impact?
An authenticated attacker can rename an arbitrary workspace in the deployment. The handler may return PERMISSION_DENIED even though the workspace update has already been committed.
How can administrators tell whether an attempted unauthorized rename succeeded?
Do not rely solely on a PERMISSION_DENIED response from the handler, because it can be issued after the database update. Verify the target workspace's current name and review workspace-change records if available.
What can be done while patching is unavailable?
Restrict access to the Identity/UpdateWorkspace gRPC operation to trusted users or disable it where operationally feasible. Monitor workspace names for unexpected changes, since base USER-role accounts are affected.