{"id":"GHSA-c6v2-3ffm-vcmc","revision":"b8142b82282d48b69cd2bbc21fd44e60","records":[{"revision":"b8142b82282d48b69cd2bbc21fd44e60","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-c6v2-3ffm-vcmc","aliases":["CVE-2026-49258","GO-2026-5816"],"title":"Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)","description":"## Summary\n\nThe web UI (`/ui/*`) does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators.\n\n## Impact\n\nA non-admin operator can:\n\n- **Block or delete any other operator's host.** `POST /ui/hosts/{id}/block` and `DELETE /ui/hosts/{id}` act on the URL `id` with no ownership check, so a non-admin can block (revoking the host's certificate via the blocklist) or delete any host in the deployment — a cross-operator denial of service.\n- **Read every operator's hosts and networks.** The dashboard, `/ui/hosts`, the host detail page, `/ui/networks` (including the create-form error re-render), and the `/ui/events` stream all return data across all operators, exposing host names, Nebula IPs, public IPs, certificate fingerprints and expiry, and network names and CIDRs.\n\nThis is the same cross-operator class as GHSA-598g; that remediation covered the JSON API but not the web read/mutation surface. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped.\n\nAffected handlers (`internal/web`): `handleHostDetail`, `handleHostBlock`, `handleHostDelete`, `handleDashboard`, `handlePartialStats`, `handleHosts`, `handleNetworks`, `renderNetworksError`, `handleHostEvents`.\n\n## Conditions\n\nExposure requires at least one non-admin operator to exist (self-registration enabled, OIDC, or an admin-created user). A single-admin deployment with no additional operators is not affected.\n\n## Fix\n\nA complete candidate fix with regression tests is ready in a private repository shared with the maintainer (`ak2k/nebula-mesh-ghsa-web`, PR #1): scope these handlers to the session operator's owned CAs (admins keep the full view), mirroring the API's ownership checks.","state":0,"publishedAt":"2026-06-26T21:29:02+00:00","modifiedAt":"2026-07-07T16:11:03.9093+00:00","affected":[{"ecosystem":"Go","name":"github.com/juev/nebula-mesh","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"0.3.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/juev/nebula-mesh/security/advisories/GHSA-c6v2-3ffm-vcmc","https://github.com/juev/nebula-mesh"],"sourceUrl":"https://github.com/advisories/GHSA-c6v2-3ffm-vcmc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-c6v2-3ffm-vcmc","identifiers":["GHSA-c6v2-3ffm-vcmc","CVE-2026-49258","GO-2026-5816"]},"retained":false,"historicalAffected":[]}],"coverage":[]}