OpenCVE versions before 3.1.0 contain a vulnerability in the organizations API endpoint where the token's organization scope is not properly enforced. Instead of restricting access to the token's organization, the API returns all organizations the token creator belongs to. This allows attackers with organization-scoped tokens to bypass intended isolation boundaries and access information about multiple organizations.