CVE-2026-50167: CWE-639: Authorization Bypass Through User-Controlled Key in kurrier-org kurrier
Kurrier versions prior to 1.2.4 contain an authorization bypass vulnerability where API endpoints for listing and retrieving webhook and identity resources do not enforce ownership checks. This allows an attacker with a valid API key to access metadata of webhook and identity resources belonging to other users. The issue affects GET and list operations but does not allow modification or access with invalid or anonymous keys. The vulnerability is fixed in version 1.2.4.
AI Analysis
Technical Summary
Kurrier, a self-hosted workspace platform, had a vulnerability (CVE-2026-50167) in versions before 1.2.4 where API endpoints for webhook and identity resource retrieval did not verify resource ownership. Authenticated users with valid API keys could enumerate and read metadata of other users' webhook and identity resources via specific API routes. Modification operations and unauthorized access with invalid keys were not affected. This is an authorization bypass classified under CWE-639. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) and was fixed in version 1.2.4.
Potential Impact
An attacker with a valid API key can access metadata of webhook and identity resources belonging to other users, potentially exposing sensitive information about those resources. However, the attacker cannot modify resources or access them without a valid API key. Anonymous and invalid API key requests are rejected, limiting the scope to authenticated users only.
Mitigation Recommendations
Upgrade Kurrier to version 1.2.4 or later, where the authorization checks for webhook and identity resource API endpoints have been properly enforced. No other mitigation is indicated by the vendor advisory.
CVE-2026-50167: CWE-639: Authorization Bypass Through User-Controlled Key in kurrier-org kurrier
Description
Kurrier versions prior to 1.2.4 contain an authorization bypass vulnerability where API endpoints for listing and retrieving webhook and identity resources do not enforce ownership checks. This allows an attacker with a valid API key to access metadata of webhook and identity resources belonging to other users. The issue affects GET and list operations but does not allow modification or access with invalid or anonymous keys. The vulnerability is fixed in version 1.2.4.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/kurrier-org/kurrierRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kurrier, a self-hosted workspace platform, had a vulnerability (CVE-2026-50167) in versions before 1.2.4 where API endpoints for webhook and identity resource retrieval did not verify resource ownership. Authenticated users with valid API keys could enumerate and read metadata of other users' webhook and identity resources via specific API routes. Modification operations and unauthorized access with invalid keys were not affected. This is an authorization bypass classified under CWE-639. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) and was fixed in version 1.2.4.
Potential Impact
An attacker with a valid API key can access metadata of webhook and identity resources belonging to other users, potentially exposing sensitive information about those resources. However, the attacker cannot modify resources or access them without a valid API key. Anonymous and invalid API key requests are rejected, limiting the scope to authenticated users only.
Mitigation Recommendations
Upgrade Kurrier to version 1.2.4 or later, where the authorization checks for webhook and identity resource API endpoints have been properly enforced. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-03T20:54:20.433Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a84a24cc6e8be033294f6b1
Added to database: 08/18/2026, 18:19:56 UTC
Last enriched: 08/18/2026, 18:38:45 UTC
Last updated: 08/18/2026, 18:53:34 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.