A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting… (CVE-2026-15630)

This vulnerability arises from improper authorization validation in a multi-tenant environment. Specifically, a non-global organization admin's permissions are checked against a tenant identifier parameter (?id=), but the actual resource action is derived from the request body, enabling the admin to perform unauthorized operations across tenant boundaries. The CVSS score of 9.9 reflects the critical nature of this flaw, with network attack vector, low complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability of resources across tenants.

An attacker with non-global organization admin privileges in one tenant can bypass tenant isolation controls to delete, create, or modify resources in any other tenant. This leads to complete compromise of data confidentiality, integrity, and availability across multiple tenants, potentially affecting all resources managed by the vulnerable system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict non-global organization admin privileges and monitor for unusual cross-tenant activity. Avoid relying solely on identifier parameters for authorization decisions.