CVE-2026-92764: OpenCVE before 3.1.0 Organization API Ignores Token Scope
OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an organization-scoped token created by a user who belongs to multiple organizations. The exposed organizations are the memberships of the user who created that token.
What information can be accessed?
The affected organizations API endpoint can list and retrieve every organization that the token creator belongs to, rather than limiting results to the organization assigned to the token. The provided data describes an information disclosure impact only.
Are default deployments affected?
The issue affects OpenCVE versions before 3.1.0 when organization-scoped tokens are used. The provided data does not state whether such tokens are enabled or created by default.
How can I determine whether my deployment is vulnerable?
Check whether the OpenCVE version is earlier than 3.1.0 and whether organization-scoped tokens exist for users with memberships in more than one organization. Such tokens may be able to retrieve organizations outside their intended scope.