Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-65967 (GCVE-0-2026-65967)

Vulnerability from nvd – Published: 2026-11-11 18:33 – Updated: 2026-11-12 19:38

Title

Fider: Server-Side Request Forgery (SSRF) via Webhook URL

Summary

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-12 19:37 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7846 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/getfider/fider/security/adviso…	x_refsource_CONFIRM
https://github.com/getfider/fider/releases/tag/v0.34.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getfider	fider	Affected: < 0.34.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65967",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T19:37:46.515516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T19:38:06.884Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fider",
          "vendor": "getfider",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.34.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:33:09.909Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"
        },
        {
          "name": "https://github.com/getfider/fider/releases/tag/v0.34.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getfider/fider/releases/tag/v0.34.0"
        }
      ],
      "source": {
        "advisory": "GHSA-g445-xwm7-594r",
        "discovery": "UNKNOWN"
      },
      "title": "Fider: Server-Side Request Forgery (SSRF) via Webhook URL"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-65967",
    "datePublished": "2026-11-11T18:33:09.909Z",
    "dateReserved": "2026-07-23T18:15:14.579Z",
    "dateUpdated": "2026-11-12T19:38:06.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65840 (GCVE-0-2026-65840)

Vulnerability from nvd – Published: 2026-11-11 18:32 – Updated: 2026-11-12 17:56

Title

Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey

Summary

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-12 16:31 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7846 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/getfider/fider/security/adviso…	x_refsource_CONFIRM
https://github.com/getfider/fider/releases/tag/v0.36.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getfider	fider	Affected: < 0.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65840",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T16:31:15.248085Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T17:56:10.000Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fider",
          "vendor": "getfider",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:32:50.465Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getfider/fider/security/advisories/GHSA-vxjw-gv4f-vq58",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getfider/fider/security/advisories/GHSA-vxjw-gv4f-vq58"
        },
        {
          "name": "https://github.com/getfider/fider/releases/tag/v0.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getfider/fider/releases/tag/v0.36.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vxjw-gv4f-vq58",
        "discovery": "UNKNOWN"
      },
      "title": "Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-65840",
    "datePublished": "2026-11-11T18:32:50.465Z",
    "dateReserved": "2026-07-22T23:16:47.753Z",
    "dateUpdated": "2026-11-12T17:56:10.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102877 (GCVE-0-2026-102877)

Vulnerability from nvd – Published: 2026-09-29 20:01 – Updated: 2026-09-30 19:26

Title

Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Summary

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:26 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/getfider/fider/security/adviso…	vendor-advisory
https://github.com/getfider/fider/commit/45f5627b…	patch
https://github.com/getfider/fider/blob/v0.37.0/ap…	technical-description
https://github.com/getfider/fider/blob/v0.37.0/ap…	technical-description
https://github.com/getfider/fider/releases/tag/v0.38.0	release-notes
https://github.com/getfider/fider	product
https://www.vulncheck.com/advisories/fider-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getfider	fider	Affected: 0 , < 0.38.0 (semver) Unaffected: 0.38.0 (semver)

Date Public

2026-09-28 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102877",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:26:25.368149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:26:51.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/getfider/fider",
          "product": "fider",
          "vendor": "getfider",
          "versions": [
            {
              "lessThan": "0.38.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.38.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-09-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T20:01:06.796Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-whx4-hxwq-qgjh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/getfider/fider/security/advisories/GHSA-whx4-hxwq-qgjh"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.go"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.go"
        },
        {
          "name": "fider v0.38.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/getfider/fider/releases/tag/v0.38.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/getfider/fider"
        },
        {
          "name": "VulnCheck Advisory: Fider before 0.38.0 SSRF via DNS rebinding in webhook validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/fider-before-0.38.0-ssrf-via-dns-rebinding-in-webhook-validation"
        }
      ],
      "title": "Fider before 0.38.0 SSRF via DNS rebinding in webhook validation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102877",
    "datePublished": "2026-09-29T20:01:06.796Z",
    "dateReserved": "2026-09-29T17:33:19.099Z",
    "dateUpdated": "2026-09-30T19:26:51.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65967 (GCVE-0-2026-65967)

Vulnerability from cvelistv5 – Published: 2026-11-11 18:33 – Updated: 2026-11-12 19:38

Title

Fider: Server-Side Request Forgery (SSRF) via Webhook URL

Summary

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-12 19:37 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7846 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/getfider/fider/security/adviso…	x_refsource_CONFIRM
https://github.com/getfider/fider/releases/tag/v0.34.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getfider	fider	Affected: < 0.34.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65967",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T19:37:46.515516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T19:38:06.884Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fider",
          "vendor": "getfider",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.34.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:33:09.909Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"
        },
        {
          "name": "https://github.com/getfider/fider/releases/tag/v0.34.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getfider/fider/releases/tag/v0.34.0"
        }
      ],
      "source": {
        "advisory": "GHSA-g445-xwm7-594r",
        "discovery": "UNKNOWN"
      },
      "title": "Fider: Server-Side Request Forgery (SSRF) via Webhook URL"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-65967",
    "datePublished": "2026-11-11T18:33:09.909Z",
    "dateReserved": "2026-07-23T18:15:14.579Z",
    "dateUpdated": "2026-11-12T19:38:06.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65840 (GCVE-0-2026-65840)

Vulnerability from cvelistv5 – Published: 2026-11-11 18:32 – Updated: 2026-11-12 17:56

Title

Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey

Summary

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-12 16:31 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7846 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/getfider/fider/security/adviso…	x_refsource_CONFIRM
https://github.com/getfider/fider/releases/tag/v0.36.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getfider	fider	Affected: < 0.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65840",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T16:31:15.248085Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T17:56:10.000Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fider",
          "vendor": "getfider",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:32:50.465Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getfider/fider/security/advisories/GHSA-vxjw-gv4f-vq58",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getfider/fider/security/advisories/GHSA-vxjw-gv4f-vq58"
        },
        {
          "name": "https://github.com/getfider/fider/releases/tag/v0.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getfider/fider/releases/tag/v0.36.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vxjw-gv4f-vq58",
        "discovery": "UNKNOWN"
      },
      "title": "Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-65840",
    "datePublished": "2026-11-11T18:32:50.465Z",
    "dateReserved": "2026-07-22T23:16:47.753Z",
    "dateUpdated": "2026-11-12T17:56:10.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102877 (GCVE-0-2026-102877)

Vulnerability from cvelistv5 – Published: 2026-09-29 20:01 – Updated: 2026-09-30 19:26

Title

Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Summary

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:26 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/getfider/fider/security/adviso…	vendor-advisory
https://github.com/getfider/fider/commit/45f5627b…	patch
https://github.com/getfider/fider/blob/v0.37.0/ap…	technical-description
https://github.com/getfider/fider/blob/v0.37.0/ap…	technical-description
https://github.com/getfider/fider/releases/tag/v0.38.0	release-notes
https://github.com/getfider/fider	product
https://www.vulncheck.com/advisories/fider-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getfider	fider	Affected: 0 , < 0.38.0 (semver) Unaffected: 0.38.0 (semver)

Date Public

2026-09-28 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102877",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:26:25.368149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:26:51.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/getfider/fider",
          "product": "fider",
          "vendor": "getfider",
          "versions": [
            {
              "lessThan": "0.38.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.38.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-09-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T20:01:06.796Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-whx4-hxwq-qgjh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/getfider/fider/security/advisories/GHSA-whx4-hxwq-qgjh"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.go"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.go"
        },
        {
          "name": "fider v0.38.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/getfider/fider/releases/tag/v0.38.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/getfider/fider"
        },
        {
          "name": "VulnCheck Advisory: Fider before 0.38.0 SSRF via DNS rebinding in webhook validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/fider-before-0.38.0-ssrf-via-dns-rebinding-in-webhook-validation"
        }
      ],
      "title": "Fider before 0.38.0 SSRF via DNS rebinding in webhook validation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102877",
    "datePublished": "2026-09-29T20:01:06.796Z",
    "dateReserved": "2026-09-29T17:33:19.099Z",
    "dateUpdated": "2026-09-30T19:26:51.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for fider by getfider

CVE-2026-65967 (GCVE-0-2026-65967)

CVE-2026-65840 (GCVE-0-2026-65840)

CVE-2026-102877 (GCVE-0-2026-102877)

CVE-2026-65967 (GCVE-0-2026-65967)

CVE-2026-65840 (GCVE-0-2026-65840)

CVE-2026-102877 (GCVE-0-2026-102877)