https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 20:12:27 +0000 https://db.gcve.eu/vuln/ghsa-cp3j-m783-3ph5 <p><strong>Affected:</strong> Go: github.com/identrail/identrail</p> <p>## Summary</p> <p>identrail&#39;s GitHub App connection-completion endpoint binds a fully client-supplied `installation_id` to the caller&#39;s workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation access token for the supplied `installation_id` using the app&#39;s own JWT, so an authenticated tenant can link any other identrail customer&#39;s GitHub App installation into their own workspace and read that victim organization&#39;s private repositories.</p> <p>## Affected code (default-on path, no feature flag)</p> <p>- Route: `internal/api/router.go:3590` — `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete`. `installation_id` is read from the JSON body or the attacker-controlled `X-GitHub-Installation-ID` header (`router.go:3582-3588`). - Service: `internal/api/github_connect.go:781` `CompleteGitHubConnection`. The `state` token IS rigorously bound to the caller&#39;s scope (`github_connect.go:818`: `if stateRecord.TenantID != scope.TenantID || stateRecord.WorkspaceID != project.WorkspaceID || stateRecord.ProjectID != project.ProjectID { ... }`), but the only check on `installation_id` is `request.InstallationID &lt;= 0` (`:794`). The raw client value is persisted as the workspace&#39;s connection (`:840`). - Cross-tenant read primitive: `internal/connectors/github/repositories.go:39` `ListInstallationRepositories` → `internal/connectors/github/app.go:170` mints a token vi…</p> <p><strong>Affected:</strong> Go: github.com/identrail/identrail</p> <p>## Summary</p> <p>identrail&#39;s GitHub App connection-completion endpoint binds a fully client-supplied `installation_id` to the caller&#39;s workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation access token for the supplied `installation_id` using the app&#39;s own JWT, so an authenticated tenant can link any other identrail customer&#39;s GitHub App installation into their own workspace and read that victim organization&#39;s private repositories.</p> <p>## Affected code (default-on path, no feature flag)</p> <p>- Route: `internal/api/router.go:3590` — `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete`. `installation_id` is read from the JSON body or the attacker-controlled `X-GitHub-Installation-ID` header (`router.go:3582-3588`). - Service: `internal/api/github_connect.go:781` `CompleteGitHubConnection`. The `state` token IS rigorously bound to the caller&#39;s scope (`github_connect.go:818`: `if stateRecord.TenantID != scope.TenantID || stateRecord.WorkspaceID != project.WorkspaceID || stateRecord.ProjectID != project.ProjectID { ... }`), but the only check on `installation_id` is `request.InstallationID &lt;= 0` (`:794`). The raw client value is persisted as the workspace&#39;s connection (`:840`). - Cross-tenant read primitive: `internal/connectors/github/repositories.go:39` `ListInstallationRepositories` → `internal/connectors/github/app.go:170` mints a token vi…</p> https://db.gcve.eu/vuln/ghsa-cp3j-m783-3ph5