← Database

CVE-2026-125752

MEDIUM CVSS: 5.0 Published: 2026-11-10 Modified: 2026-11-10

Description

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.

Affected Platforms

Unknown

Weakness Type

CWE-639

References