EUVD-2026-83051
GHSA-p5vg-v7mj-f6q4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid project-scoped API key or account
-
DeliveryEnumerate/guess another tenant's Source ID
-
ExploitRequest GET /projects/{own}/sources/{victimSourceID}
-
ExecutionServer skips ProjectID check in FindSourceByID
-
ImpactReceive victim's unredacted broker credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires (1) a valid authenticated user session or a project-scoped API key for at least one Convoy project - PR:L, not unauthenticated; and (2) knowledge or enumeration of another tenant's Source identifier (UID). Exploitation targets the single-item endpoint GET /api/v1/projects/{projectID}/sources/{sourceID} only - the list endpoint remains correctly project-scoped and is NOT affected. Realistic risk is limited to multi-tenant / shared Convoy deployments running a version prior to 26.6.8; a single-tenant instance has no cross-tenant boundary to violate. No user interaction and no elevated privileges are required beyond the low-privilege project credential. |
| Impact | This is a genuine, high-confidence authorization flaw (IDOR/BOLA, CWE-639) whose real-world risk is moderate-to-high for anyone running multi-tenant Convoy. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) is internally consistent with the description: a network-reachable, low-complexity request requiring only a valid low-privilege project-scoped credential yields high confidentiality impact (unredacted broker credentials) with no integrity or availability effect. No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a priority driven by impact (plaintext AMQP/Kafka/SQS/Google PubSub credentials for other tenants) rather than by exploitation telemetry. The exploit is trivially reliable once an attacker holds any authenticated project scope, but it is bounded to organizations running Convoy in a shared/multi-tenant configuration. Note the fixing PR (#2755) also bundles an UNRELATED JWT logout-bypass fix (GHSA-hpqj-2j2x-p5p2, base64url signature re-spelling); that JWT change is not this CVE and should not be conflated with the Source-scope fix in internal/sources/impl.go. |
| Exploit ScenarioDerived | An attacker who legitimately holds a low-privilege API key or user account scoped to their own Convoy project calls GET /api/v1/projects/{theirProjectID}/sources/{victimSourceID}, substituting another tenant's Source identifier in the path. Because Handler.GetSource → FindSourceByID looked up the Source by ID alone without confirming its ProjectID matched the authorized project, the API returns the victim's full Source record including unredacted AMQP/Kafka/SQS/Google PubSub credentials. No public POC is provided, but the CVSS AC:L and the one-line source fix confirm exploitation is straightforward given a valid credential. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Cross-tenant credential disclosure in Convoy (frain-dev/convoy) prior to version 26.6.8 lets an authenticated user or project-scoped API key holder read another tenant's Source record - including unredacted AMQP, Kafka, SQS, and Google PubSub broker credentials - by substituting a foreign Source identifier in GET /api/v1/projects/{projectID}/sources/{sourceID}. The endpoint correctly authorizes the project in the URL but Handler.GetSource resolves the Source purely by sourceID, so the object-level ownership check is missing (IDOR/BOLA, CWE-639). Exploitation requires only a low-privilege authenticated credential (CVSS:4.0 PR:L, CVSS:3.1 PR:L) plus knowledge or enumeration of the target Source UID; the list endpoint remains properly project-scoped and is not affected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and a vendor-released patch is available in 26.6.8.
RemediationAI
Upgrade to Convoy 26.6.8 or later - vendor-released patch: 26.6.8 - which scopes FindSourceByID to the authorized project and returns ErrSourceNotFound for cross-project lookups (see the release at https://github.com/frain-dev/convoy/releases/tag/v26.6.8, advisory GHSA-p5vg-v7mj-f6q4, and PR #2755). Because the pre-fix endpoint returned unredacted AMQP, Kafka, SQS, and Google PubSub credentials, treat any Convoy instance running a version below 26.6.8 in a shared or multi-tenant configuration as potentially exposed and rotate every broker credential stored on Sources in that instance after patching; patching alone does not invalidate secrets an attacker may already have retrieved. If immediate upgrade is not possible, the most effective compensating control is to block or restrict the single-item read path - for example, have a reverse proxy or ingress deny requests matching GET /api/v1/projects/*/sources/* while continuing to allow the list endpoint and other API routes - accepting the trade-off that legitimate UI and API clients that fetch a single Source by ID will break and must fall back to listing Sources. A weaker alternative is to tighten authentication by disabling long-lived project-scoped API keys and issuing only narrowly scoped short-lived credentials, but this does not fix the missing ownership check and only raises the bar for an attacker who already holds one project credential. Where feasible, segment tenants onto separate Convoy instances so no single credential can reach another tenant's project namespace, and review API access logs for GET /api/v1/projects/{projectID}/sources/{sourceID} requests where the returned Source UID belongs to a different project, as this pattern indicates exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Convoy is a cloud-native webhooks gateway written in Go that organizes configuration into projects, each containing Sources that are bound to downstream message brokers (AMQP, Kafka, SQS, Google PubSub) and therefore store live broker credentials. The flaw is an object-level authorization failure (CWE-639, Authorization Bypass Through User-Controlled Key), the server-side variant commonly called IDOR or BOLA. The HTTP handler GetSource authorizes the {projectID} path segment but then calls sources.Service.FindSourceByID(), whose datastore query (FetchSourceByID) is keyed only on the source UID and does not filter by project - unlike its sibling operations FindSourceByName and DeleteSourceByID, which scope the lookup in SQL. Because the single-item read path lacked that predicate, any caller holding a valid session or project-scoped API key for one project could pass another project's Source UID and receive the full, unredacted Source record including plaintext broker secrets. The upstream fix in PR #2755 (commit 1cc67cd1) makes FindSourceByID project-scoped, comparing source.ProjectID against the authorized projectID and returning datastore.ErrSourceNotFound on mismatch so that cross-project hits are indistinguishable from nonexistent IDs and Source UIDs remain non-enumerable; the accompanying test previously documented the unsafe behavior and now asserts the scoped ErrSourceNotFound. The same pull request additionally hardens JWT logout blacklisting by canonicalizing the signature segment (addressing GHSA-hpqj-2j2x-p5p2), which is a separate issue and not the subject of this CVE.
Know when Convoy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network endpoint, low complexity, requires a low-privilege project-scoped credential (PR:L); pure confidentiality loss of high-value broker credentials (C:H), no integrity or availability impact, scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.
Technical POC Analysis
Advisory: GHSA-p5vg-v7mj-f6q4 (frain-dev/convoy).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Convoy, an open-source webhook delivery platform used to route events into message brokers, fails to enforce tenant isolation in versions prior to 26.6.8: any authenticated user or holder of a project-scoped API key can retrieve another tenant's Source record, including unredacted AMQP, Kafka, SQS, and Google PubSub broker credentials. Because a single low-privilege credential and a guessed or enumerated Source identifier are sufficient, every tenant sharing one Convoy instance is potentially exposed, and leaked broker credentials can be reused outside Convoy to read or publish messages in downstream messaging infrastructure. Leadership should treat this as a high-priority tenant-isolation failure requiring rapid upgrade and credential rotation, not merely a code defect.
Apply vendor patch (upgrade to Convoy 26.6.8 or later). Until the upgrade completes, restrict Convoy to a single trusted tenant or isolate tenants per instance, revoke or narrow all project-scoped API keys, rotate the affected AMQP/Kafka/SQS/Google PubSub broker credentials, and monitor for cross-project sourceID access attempts on the sources endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB