EUVD-2026-24748Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability in the web application allows unauthorized users to access and manipulate sensitive data across different tenants by exploiting insecure direct object references. This could lead to unauthorized access to sensitive information and unauthorized changes to the tenant's configuration.
AnalysisAI
Insecure direct object references in Augmentt 1.0 allow unauthenticated remote attackers to access and modify sensitive tenant data across different organizational contexts, bypassing authentication mechanisms through direct manipulation of object identifiers. The vulnerability enables both unauthorized information disclosure and modification of tenant configuration with CVSS 6.5 (medium severity); no public exploit code has been identified at the time of analysis, though the attack is automatable and requires no user interaction.
Technical ContextAI
The vulnerability stems from insecure direct object references (IDOR), a common web application design flaw where the application exposes internal object identifiers (such as tenant IDs, user IDs, or configuration resource IDs) in URLs or API parameters without proper authorization validation. When a user requests a resource via a direct reference (e.g., /api/tenant/123/config), the application fails to verify that the requesting user belongs to or has permission to access tenant 123, allowing an attacker to enumerate or modify other tenants' data by simply changing the identifier. This affects Augmentt across versions as specified in CPE cpe:2.3:a:augmentt:augmentt:*:*:*:*:*:*:*:* (all versions potentially affected, with Augmentt 1.0 explicitly confirmed), and is classified under authentication bypass and information disclosure attack categories.
RemediationAI
No vendor-released patch has been identified at time of analysis. Organizations should contact Augmentt support immediately to request a security update addressing IDOR validation in multi-tenant contexts. As an immediate compensating control, implement strict authorization validation at the API gateway or application layer: verify on every request that the authenticated user (obtained via valid authentication token or session) has explicit permission to access the requested tenant resource before returning or modifying data. This requires mapping each request's tenant identifier against the authenticated user's permitted tenants and rejecting requests that do not match. Additionally, implement comprehensive audit logging of all data access and modification requests (including tenant ID, user, action, and timestamp) to detect and investigate suspicious cross-tenant access patterns. If API versioning is available, consider deprecating endpoints with direct object references in favor of relative resource paths (e.g., /api/me/config instead of /api/tenant/123/config) where the server determines the user's tenant context server-side rather than accepting it from the client. These controls have minimal performance impact but require careful implementation to avoid authorization bypass loopholes.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today