CVE-2026-89112: Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure
The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs an authenticated account with limited privileges. No user interaction is required.
What request pattern is associated with the authorization bypass?
The issue occurs when the admin API endpoint for CLA signature records is queried with a target organisation specified by organisation ID. Authorization checks are not consistently enforced for that form of target selection.
What information could be exposed?
Affected requests may return CLA signature records containing contributor information from organisations the requester is not authorized to administer.