What is the CVSS score of CVE-2026-50875?

CVE-2026-50875 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Deck9 Input are affected by CVE-2026-50875?

Deck9 Input v2.0.1 contains a broken access control vulnerability enabling any authenticated user to modify or delete webhooks belonging to other organizations, creating a cross-tenant isolation…

How to fix or mitigate CVE-2026-50875?

Within 24 hours, catalog all Deck9 Input v2.0.1 deployments and the business-critical integrations they power, then assess the number of external users with webhook management access. Within 7 days, implement network access controls restricting webhook endpoints to authorized IP ranges, enable comprehensive audit logging for all webhook operations (create, update, delete), and revoke unnecessary user access to webhook management functions. Within 30 days, upgrade Deck9 Input to a patched version once available from the vendor, conduct forensic review of webhook modification logs to detect unauthorized changes, and notify affected customers of the flaw and remediation timeline.

Deck9 Input CVE-2026-50875

EUVD-2026-36773 HIGH

Improper Access Control (CWE-284)

2026-06-15 mitre

GHSA-42j4-px2f-mhr5

Authentication Bypass N A

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable endpoint with low complexity, requires an authenticated tenant account (PR:L), no confidentiality impact but full modify/delete of other tenants' webhooks (I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:59 vuln.today

CVE Published

Jun 15, 2026 - 00:00 cve.org

HIGH 8.1

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated attackers to arbitrarily modify or delete another tenant's webhook via a crafted request.

AnalysisAI

Cross-tenant webhook tampering in Deck9 Input v2.0.1 lets any authenticated user modify or delete webhooks belonging to other tenants by targeting the /{form}/webhooks/{webhook} endpoint with a crafted request. Because the endpoint fails to verify that the requesting tenant owns the referenced webhook (a classic broken-access-control / IDOR pattern), attackers can silently redirect, corrupt, or destroy another organization's integration data. Publicly available exploit code exists (proof-of-concept gist), though EPSS remains low at 0.15% and the flaw is not listed in CISA KEV.

Technical ContextAI

Deck9 Input is a hosted form/data-collection platform where webhooks are used to push submitted form data to external systems. The vulnerable route /{form}/webhooks/{webhook} exposes webhook objects by identifier without enforcing that the authenticated caller's tenant matches the webhook's owning tenant. This is CWE-284 (Improper Access Control) manifesting as a horizontal, cross-tenant authorization failure: the server authenticates the user but does not authorize the specific object, so the {webhook} path parameter can be substituted with another tenant's identifier. The supplied CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and provides no additional product-matching detail beyond the product/version in the description.

RemediationAI

No vendor-released patch version is identified at time of analysis, so treat remediation as compensating controls until Deck9 publishes a fixed release. The core fix must enforce object-level authorization on /{form}/webhooks/{webhook} so that a webhook can only be read, modified, or deleted by its owning tenant - verify tenant ownership server-side rather than trusting the {webhook} identifier. As interim controls: restrict or monitor access to webhook management endpoints (e.g., gateway/WAF rules that log and rate-limit requests to /*/webhooks/* and flag cross-tenant identifier patterns), reduce the number of accounts holding webhook-management privileges, and periodically audit/back up webhook configurations so unauthorized modification or deletion can be detected and restored (trade-off: these do not prevent exploitation, only limit blast radius and speed recovery). Track https://nvd.nist.gov/vuln/detail/CVE-2026-50875 for an official fixed version and apply it once released.