meteroid-oss vulnerabilities and threats

Meteroid versions before 2.2.0 have an authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler. The vulnerability arises because the UPDATE query filters only on coupon ID and does not verify the tenant ID. This allows authenticated users with catalog:manage permission or a tenant-scoped API key to manipulate coupons belonging to other tenants, including disabling, archiving, or re-enabling them, and to access their details.

Meteroid versions before 2.2.0 have an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler. This flaw allows authenticated users with settings:read permission to access another tenant's API token ID and retrieve its Argon2 secret hash and tenant ID, bypassing tenant context checks.