CVE-2026-81505: CWE-639: Authorization Bypass Through User-Controlled Key in frain-dev convoy
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.
AI Analysis
Technical Summary
Convoy versions before 26.6.8 contain an authorization bypass vulnerability (CWE-639) in the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint. While the endpoint authorizes access based on the projectID in the URL, the underlying service fetches the Source record solely by sourceID without confirming the Source's ProjectID matches the authorized project. This allows an authenticated user or project-scoped API key holder to substitute another tenant's Source identifier and retrieve that Source's full record, exposing unredacted credentials for AMQP, Kafka, SQS, or Google PubSub. The vulnerability affects only the single-item Source lookup; the list endpoint remains properly scoped. The issue is resolved in version 26.6.8.
Potential Impact
An attacker with authentication or a project-scoped API key can access sensitive credentials belonging to other tenants by exploiting the authorization bypass. This exposure of unredacted messaging service credentials (AMQP, Kafka, SQS, Google PubSub) could lead to unauthorized access or abuse of those messaging systems. The vulnerability does not affect the listing of Sources, only the retrieval of individual Source records by ID.
Mitigation Recommendations
Upgrade to Convoy version 26.6.8 or later, where this authorization bypass vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
CVE-2026-81505: CWE-639: Authorization Bypass Through User-Controlled Key in frain-dev convoy
Description
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.
CVSS v4.0
Score 7.1high
Affected software
frain-dev
convoy
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Convoy versions before 26.6.8 contain an authorization bypass vulnerability (CWE-639) in the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint. While the endpoint authorizes access based on the projectID in the URL, the underlying service fetches the Source record solely by sourceID without confirming the Source's ProjectID matches the authorized project. This allows an authenticated user or project-scoped API key holder to substitute another tenant's Source identifier and retrieve that Source's full record, exposing unredacted credentials for AMQP, Kafka, SQS, or Google PubSub. The vulnerability affects only the single-item Source lookup; the list endpoint remains properly scoped. The issue is resolved in version 26.6.8.
Potential Impact
An attacker with authentication or a project-scoped API key can access sensitive credentials belonging to other tenants by exploiting the authorization bypass. This exposure of unredacted messaging service credentials (AMQP, Kafka, SQS, Google PubSub) could lead to unauthorized access or abuse of those messaging systems. The vulnerability does not affect the listing of Sources, only the retrieval of individual Source records by ID.
Mitigation Recommendations
Upgrade to Convoy version 26.6.8 or later, where this authorization bypass vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-26T20:58:58.083Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aad678855bf5e2cf53e103b
Added to database: 09/18/2026, 16:32:08 UTC
Last enriched: 09/18/2026, 16:46:34 UTC
Last updated: 09/19/2026, 01:59:41 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.