Obot CVE-2026-105140

Exploitation requires that (1) a user's group membership was just revoked in the upstream auth/identity provider, and (2) two or more group-refresh operations for that same identity run concurrently and commit to the database out of order - the specific condition the fix addresses by serializing refreshes with golang.org/x/sync/singleflight and adding an auth_provider_groups_last_checked claim check in persistGroups. Limiting factors that reduce real-world risk: the attacker (or affected user) must already be authenticated (PR:L), the race is timing-dependent and not attacker-controllable (AT:P, AC:H), the stale access self-heals after roughly ten minutes (bounded by the group check period), and impact is confined to retaining previously-held group-based access rather than gaining new privileges. This is only meaningful where group refreshes legitimately overlap during an active revocation.

This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The vendor-assigned CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) scores only 2.3: exploitation requires an already-authenticated user (PR:L), high attack complexity (AC:H), and a present-but-uncontrollable race condition (AT:P), with only low confidentiality and integrity impact (VC:L/VI:L) and no availability impact. There is no CISA KEV listing and no public exploit code identified, so this is neither actively exploited nor weaponized. EPSS is not provided in the input, but given the timing-dependent, non-attacker-controlled nature of the flaw, meaningful exploitation probability would be expected to be very low. The one caveat is window of exposure rather than attacker capability: the flaw silently extends revoked access for roughly ten minutes, which matters for high-assurance environments performing emergency de-provisioning (e.g., offboarding or incident response) but is not a broadly exploitable vulnerability. No key signals conflict with the description; the main gap is the absence of EPSS data in the input.

An administrator revokes a user's group membership in the upstream identity provider (for example, during offboarding or an access incident). Because two group-refresh operations for that same user commit to Obot's database out of order, the stale membership is re-persisted, and the user continues to hold the revoked group-based access for about ten minutes. No public exploit code exists, the condition is not attacker-controlled (AT:P), and triggering it reliably requires winning a narrow timing race (AC:H).