{"id":"EUVD-2026-112081","enisaUuid":"bb3efa4b-ae77-3310-9e4e-94f270336e21","description":"identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller\u0027s workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller\u0027s tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller\u0027s connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application\u0027s JWT. An authenticated tenant who starts a legitimate connection can supply another customer\u0027s non-secret installation ID to read the victim organization\u0027s private repository inventory, content, and metadata or drive posture scans, provided identrail\u0027s GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2.","datePublished":"Oct 28, 2026, 1:15:53 PM","dateUpdated":"Oct 28, 2026, 4:07:10 PM","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5\nhttps://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7\nhttps://github.com/identrail/identrail/releases/tag/v1.0.2\n","aliases":"CVE-2026-59185\nGHSA-cp3j-m783-3ph5\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"a3fbc67d-bee5-3a37-985d-c30846a8f381","product":{"name":"identrail","vendor":{"name":"identrail"}},"product_version":"\u003c 1.0.2"}],"enisaIdVendor":[{"id":"f68af2cd-1a87-3f37-8b9a-db5ee7c0c8e7","vendor":{"name":"identrail"}}],"enisaIdVulnerability":[{"id":"36201bd7-a03c-3fc8-891c-433600ef8b83","vulnerability":{"id":"GHSA-cp3j-m783-3ph5","description":"Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller\u0027s workspace without ownership verification","datePublished":"Sep 9, 2026, 11:52:14 PM","dateUpdated":"Sep 9, 2026, 11:52:14 PM","baseScore":0.0,"references":"https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5\nhttps://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7\nhttps://github.com/identrail/identrail\nhttps://github.com/identrail/identrail/releases/tag/v1.0.2\n","enisa_id":"EUVD-2026-112081\n","aliases":"CVE-2026-59185\nGHSA-cp3j-m783-3ph5\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"49f5d9e4-6a5b-3f0b-8583-6301127e6d87","vulnerability":{"id":"CVE-2026-59185","description":"identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller\u0027s workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller\u0027s tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller\u0027s connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application\u0027s JWT. An authenticated tenant who starts a legitimate connection can supply another customer\u0027s non-secret installation ID to read the victim organization\u0027s private repository inventory, content, and metadata or drive posture scans, provided identrail\u0027s GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2.","datePublished":"Oct 28, 2026, 1:15:53 PM","dateUpdated":"Oct 28, 2026, 4:07:10 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5\nhttps://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7\nhttps://github.com/identrail/identrail/releases/tag/v1.0.2\n","enisa_id":"EUVD-2026-112081\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Oct 30, 2026, 12:00:36 PM","vulnerabilityProduct":[{"id":"fbaa982c-e68a-3a78-92c7-93b38dd8e408","product":{"name":"identrail","vendor":{"name":"identrail"}},"product_version":"\u003c 1.0.2"}],"vulnerabilityVendor":[{"id":"bdcb0d26-265c-3364-9006-ead56c0700b2","vendor":{"name":"identrail"}}]}}],"enisaIdAdvisory":[]}