CVE-2026-90448: Security vulnerability
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials. This allows an authenticated user on a deployment intended to be read-only to forge or overwrite stored records that should not be modifiable in that deployment mode.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user of a deployment configured or intended to provide read-only access can exploit it. The issue affects the proxied API route that does not restrict request methods.
What level of data modification is possible?
An attacker can create a stored record or overwrite an existing one. They can supply the record identifier, allowing them to target attacker-chosen records.
Does exploitation require direct access to elevated backend credentials?
No. The vulnerable route performs the write operation using the application's own elevated backend credentials.