CVE-2026-97691: CWE-284: Improper Access Control in get-convex convex-backend

This vulnerability (CVE-2026-97691) affects the get-convex convex-backend component of the Convex database. It involves improper access control (CWE-284) that could allow unauthorized reading of deployment information in rare cases. The flaw existed prior to the self-hosted image and local deployment binary published on August 10, 2026. The vendor has intentionally withheld detailed technical and component information to protect self-hosted deployments that have not yet updated. Convex cloud deployments were patched automatically by the vendor. The vulnerability is resolved in the self-hosted image and local binary published on August 10, 2026.

The vulnerability allows unauthorized reading of deployment information, which may expose sensitive data about the Convex deployment. There is no indication of integrity or availability impact. No evidence of exploitation in the wild is known. The CVSS score is 4.3 (medium severity), reflecting limited confidentiality impact with no integrity or availability impact.

The vulnerability is fixed in the self-hosted image and local deployment binary published on August 10, 2026. Users should update to these versions to remediate the issue. Convex cloud deployments have been automatically patched by the vendor, so no user action is required for cloud users. Since the vendor has withheld detailed technical information to protect unpatched deployments, users should prioritize applying the official update.