Which versions of Shuffle are affected by CVE-2026-92716?

A cross-tenant privilege escalation flaw in self-hosted Shuffle SOAR deployments through version 2.2.1 allows a single organization's administrator to mint or reset API keys belonging to users in any…. A patch is available.

How to fix or mitigate CVE-2026-92716?

Within 24 hours, inventory every Shuffle instance in the environment, confirm which are running version 2.2.1 or earlier, and treat all of them as affected; where the platform is internet-reachable, restrict administrative access to trusted networks or a VPN and enforce MFA on all org-admin accounts, then rotate API keys and credentials for every Shuffle user across every organization as a precaution. Within 7 days, apply the vendor-released fix - patch available per vendor advisory; no exact fix version is published in the source context, so obtain the corrected release from the upstream shuffle-shared repository or official Shuffle distribution channel and validate it in a staging tenant before production rollout - and confirm the HandleApiGeneration endpoint no longer accepts caller-supplied user IDs without authorization checks by testing cross-tenant key generation with two test organizations. Within 30 days, deploy the patched version to all remaining instances including any self-hosted edge or development deployments, audit Shuffle logs for anomalous API-key generation or reset events originating from admin accounts outside their own organization, review tenant isolation controls and network segmentation for the SOAR platform, and add a recurring patch-management and access-review cadence so multi-tenant security products are upgraded promptly.

Shuffle CVE-2026-92716

Q: What is the CVSS score of CVE-2026-92716?

CVE-2026-92716 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80899 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-16 VulnCheck

GHSA-gxxx-83g3-wgp9

Authentication Bypass Privilege Escalation Shuffle

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable API endpoint, low complexity; PR:L because org-admin authentication is required; C:H/I:H for reading/resetting foreign API keys enabling takeover, A:N as no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 18:07 vuln.today

CVE Published

Sep 16, 2026 - 17:31 cve.org

HIGH 8.6

DescriptionCVE.org

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover across tenant boundaries.

AnalysisAI

Cross-tenant privilege escalation in Shuffle (self-hosted SOAR platform) through version 2.2.1 lets an administrator who holds org-admin rights in any single organization mint and read valid API keys for arbitrary users in other organizations, resulting in full account takeover across tenant boundaries. The flaw is an IDOR/authz bypass (CWE-639) in the HandleApiGeneration endpoint, which accepts a caller-supplied user ID and returns or resets that user's API key without verifying ownership; it is remotely reachable over the network and requires only an authenticated admin account (CVSS:4.0 8.6, PR:L, UI:N, high confidentiality and integrity impact). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated account with administrator privileges in at least one Shuffle organization (PR:L); the attacker then supplies an arbitrary victim UserId to the HandleApiGeneration API-key endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine, source-code-confirmed authorization flaw (CWE-639, IDOR) rather than an inflated high-CVSS metric. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The upstream fix is available in shuffle-shared commit c1b582e91b429bc7d5ad02e6c22f98234ec67615 (https://github.com/Shuffle/shuffle-shared/commit/c1b582e91b429bc7d5ad02e6c22f98234ec67615), which adds a foundUser.Id != userInfo.Id ownership comparison that returns HTTP 401 and logs an audit entry; vendor patch status is reported as available, but a tagged released version containing the fix is not independently confirmed from the supplied data, so operators should deploy a Shuffle build whose shuffle-shared dependency includes this commit (later than v1.2.50 / Shuffle 2.2.1) and verify the diff is present before relying on it. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every Shuffle instance in the environment, confirm which are running version 2.2.1 or earlier, and treat all of them as affected; where the platform is internet-reachable, restrict administrative access to trusted networks or a VPN and enforce MFA on all org-admin accounts, then rotate API keys and credentials for every Shuffle user across every organization as a precaution. …

Threat intelligence, references, and detailed analysis are available after sign-in.