SigNoz versions up to 0.130.1 have a broken access control vulnerability that allows authenticated users to access and manipulate alert rules belonging to other organizations. This occurs because the alert rule store predicates do not filter by organization ID, resulting in missing tenant isolation. Exploiting this flaw, attackers can read, edit, and delete alert rules across organizations, bypassing multi-tenant access controls. A patch is available in version 0.130.2 to address this issue.