EUVD-2026-40141
GHSA-3vgg-7h5g-62mm
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API requires authenticated low-privilege user (PR:L) and UUID knowledge (AC:H); integrity is High for unrestricted foreign rule edit/delete, no scope change within same application.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
SigNoz through 0.130.1 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.
AnalysisAI
Broken tenant isolation in SigNoz through 0.130.1 allows authenticated users from one organization to read, modify, and delete alert rules belonging to entirely separate organizations by directly supplying a target rule UUID via API. The alert rule store predicates omit organization ID filtering - a textbook Insecure Direct Object Reference (CWE-639) - collapsing the multi-tenant access boundary. No active exploitation is confirmed (not in CISA KEV) and no public POC has been independently confirmed, though the referenced GitHub issue may expose sufficient technical detail for manual exploitation by any credentialed user on a shared SigNoz instance.
Technical ContextAI
SigNoz is an open-source, cloud-native observability platform supporting metrics, distributed traces, and logs across multi-tenant organizational boundaries. Alert rules are stored with UUIDs as their primary identifiers and are expected to be scoped to the creating organization. The vulnerability (CWE-639: Authorization Through User-Controlled Key) exists because the data store layer for alert rules - likely ORM query predicates or repository-layer filters - omits the organization ID when constructing database queries. As a result, any authenticated API request referencing a valid rule UUID succeeds regardless of organizational membership, bypassing the intended tenant isolation. This affects all CRUD operations: read, update, and delete on alert rules. The affected version ceiling is 0.130.1 based on VulnCheck and GitHub issue disclosures.
RemediationAI
Upgrade SigNoz beyond version 0.130.1 once a patched release is published by the maintainers - track fix status via the upstream GitHub issue at https://github.com/SigNoz/signoz/issues/11830, as no specific fixed version was confirmed in available intelligence at time of analysis. For self-hosted deployments operating in single-organization mode, the cross-tenant attack surface does not exist and no immediate action is required beyond monitoring for a patch. For multi-tenant deployments, consider restricting SigNoz API access at the network layer so only organization-scoped identity providers or VPN-authenticated users can reach the alert rule endpoints, reducing exposure to internal actors rather than any authenticated user. As an additional detective control, audit API access logs for requests referencing alert rule UUIDs that do not belong to the requesting user's organization. Avoid generic network segmentation that does not address the root IDOR - the fix must enforce organization ID filtering at the data store layer.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today