Convoy
Monthly
Cross-tenant credential disclosure in Convoy (frain-dev/convoy) prior to version 26.6.8 lets an authenticated user or project-scoped API key holder read another tenant's Source record - including unredacted AMQP, Kafka, SQS, and Google PubSub broker credentials - by substituting a foreign Source identifier in GET /api/v1/projects/{projectID}/sources/{sourceID}. The endpoint correctly authorizes the project in the URL but Handler.GetSource resolves the Source purely by sourceID, so the object-level ownership check is missing (IDOR/BOLA, CWE-639). Exploitation requires only a low-privilege authenticated credential (CVSS:4.0 PR:L, CVSS:3.1 PR:L) plus knowledge or enumeration of the target Source UID; the list endpoint remains properly project-scoped and is not affected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and a vendor-released patch is available in 26.6.8.
Cross-tenant credential disclosure in Convoy (frain-dev/convoy) prior to version 26.6.8 lets an authenticated user or project-scoped API key holder read another tenant's Source record - including unredacted AMQP, Kafka, SQS, and Google PubSub broker credentials - by substituting a foreign Source identifier in GET /api/v1/projects/{projectID}/sources/{sourceID}. The endpoint correctly authorizes the project in the URL but Handler.GetSource resolves the Source purely by sourceID, so the object-level ownership check is missing (IDOR/BOLA, CWE-639). Exploitation requires only a low-privilege authenticated credential (CVSS:4.0 PR:L, CVSS:3.1 PR:L) plus knowledge or enumeration of the target Source UID; the list endpoint remains properly project-scoped and is not affected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and a vendor-released patch is available in 26.6.8.