Tamery CVE-2026-119663

Requires an authenticated account on the Tamery cloud-sync service and ownership of at least one connection, so the attacker can issue a valid connectionsResources.create call; the attacker then supplies a victim's connectionId inside a batch create request, and the handler fails to verify that the caller owns that connection (CWE-639). Limiting factors: exploitation needs valid credentials (PR:L, so not unauthenticated), knowledge or discovery of the victim's connectionId, and the cloud sync feature must be in use. Impact is bounded to inserting attacker-named resource rows that surface in the victim's client (integrity only) - the flaw does not grant read access to the victim's data or affect availability.

Signals point to a genuine but moderate-priority issue, not a high-CVSS-but-low-risk inflation case nor an emergency. The CVSS 4.0 base is 5.3 (Medium) with AV:N/AC:L/PR:L/UI:N - network-reachable and low-complexity, but requiring an authenticated account (PR:L), and impact is limited to low integrity (VI:L) with no confidentiality or availability effect (VC:N/VA:N). This matches the description: an attacker cannot read or destroy a victim's data, only insert attacker-named resource rows into another user's connection listing (a cross-user write/IDOR). The vuln.today decision label is 'this_month', consistent with scheduled remediation rather than act_now/emergency. EPSS is not provided, so exploitation probability cannot be quantified; KEV status is not listed (no confirmed active exploitation). A public technical write-up (hackmd) and a GitHub issue are referenced, indicating the mechanics are publicly documented, though no verified working exploit code is confirmed in the input. No signals conflict materially; the main caveat is the absence of EPSS and the fact that real-world exploitation requires both a valid account and knowledge of a victim's connectionId. Net: patch within the normal cycle; the bounded integrity-only impact and authentication requirement keep this below emergency urgency.

An authenticated Tamery cloud-sync user who legitimately owns at least one connection crafts a batch connectionsResources.create request and substitutes a victim's connectionId, causing attacker-controlled, attacker-named resource rows to be inserted and then rendered in the victim's client. The attack is network-based and low-complexity (AV:N/AC:L) but requires a valid account (PR:L) and the target's connectionId. A public technical write-up describing the flaw exists; it is not verified as working exploit code.