CVE-2026-112000: Missing Authorization in vanus-labs vanus

CVE-2026-112000 describes a missing authorization vulnerability in vanus-labs' vanus product versions 0.8.0 through 0.9.0. The gateway component fails to enforce permission checks on critical methods such as Subscribe, Ack, and unregistered methods. As a result, any authenticated user can supply another tenant's subscription ID to hijack that subscription, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via the ListUser method. This vulnerability has a CVSS 4.0 base score of 7.2, indicating high severity with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability.

An attacker with valid authentication can hijack subscriptions belonging to other tenants, gaining unauthorized access to event data and the ability to acknowledge events on their behalf. This can disrupt legitimate consumers by starving them of events and allows enumeration of cluster users, potentially exposing sensitive information about the user base. The vulnerability affects confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to minimize exposure and monitor for suspicious subscription activity. Avoid sharing subscription IDs across tenants and consider network-level access controls to limit unauthorized access to the gateway.