ShellHub is a centralized SSH gateway. Before version 0.24.2, the GET /api/namespaces/:tenant endpoint returns the complete namespace object, including members' user IDs, emails, roles, settings, and device counts, to any caller authenticated via an API Key. The authorization check is bypassed because the handler skips membership verification when the X-ID header is missing, which occurs during API Key authentication. This results in an authorization bypass (CWE-639) allowing access to tenant data beyond the API Key's intended scope. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality but not integrity or availability. The issue is resolved in shellhub version 0.24.2.

An attacker possessing an API Key with limited tenant scope can retrieve full namespace objects for any tenant, including sensitive information such as user IDs, emails, roles, settings, and device counts. This leads to unauthorized disclosure of tenant membership and configuration data, impacting confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Upgrade shellhub to version 0.24.2 or later, where this authorization bypass vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade from the vendor's official release notes or repository. Until upgraded, restrict API Key usage and monitor for unauthorized access attempts. Patch status is not explicitly confirmed beyond the stated fix in version 0.24.2; check vendor sources for current remediation guidance.