CVE-2026-50875
Description
In Deck9 Input v2.0.1, the /{form}/webhooks/{webhook} endpoint has incorrect access control, allowing authenticated attackers to modify or delete another tenant's webhook.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
In Deck9 Input v2.0.1, the /{form}/webhooks/{webhook} endpoint has incorrect access control, allowing authenticated attackers to modify or delete another tenant's webhook.
Vulnerability
The vulnerability exists in Deck9 Input v2.0.1 within the /{form}/webhooks/{webhook} endpoint, specifically in the FormWebhookController::update() and delete methods. The authorization logic validates access based on the {form} route parameter, but the {webhook} parameter is resolved independently and is not scoped to the parent form. This lack of scoped route binding or an explicit ownership check allows an authenticated user to mutate a webhook object that belongs to a form they do not own, provided they know the webhook identifier. The issue affects all instances of Deck9 Input v2.0.1 using the webhook feature.
Exploitation
An attacker must be authenticated and know the identifier of a target webhook (webhookB) that is attached to a form they do not own. The attacker can use their own form (formA) in the request path. By sending a PUT /api/forms/{formA}/webhooks/{webhookB} request with modified webhook fields (e.g., a changed URL or enabled state), the request is authorized because the supplied {form} belongs to the attacker. The mutation is then applied to webhookB despite it belonging to another form. The same procedure works with the DELETE method to delete the foreign webhook [1].
Impact
A successful exploit results in cross-form webhook integrity loss. An authenticated attacker can redirect, disable, modify, or delete a webhook belonging to another tenant's form. This compromises the intended functionality and security of webhook-based integrations, potentially leading to unauthorized data access or service disruption.
Mitigation
Not yet disclosed in the available references. As of the publication date (2026-06-15), no patch or workaround has been published for Deck9 Input v2.0.1. Users should monitor the vendor for updates and restrict access to the webhook API where possible.
AI Insight generated on Jun 15, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The route authorization checks access to the parent form parameter but the mutation is applied to an independently bound webhook object without verifying it belongs to that form."
Attack vector
An authenticated attacker who owns formA and knows the webhook identifier (webhookB) of another tenant's form can send a PUT or DELETE request to `/api/forms/{formA}/webhooks/{webhookB}`. The authorization check passes because the attacker controls formA, but the mutation is applied to webhookB, which belongs to a different form. This violates [CWE-862: Missing Authorization] and allows the attacker to redirect, disable, modify, or delete the foreign webhook. [ref_id=1]
Affected code
The vulnerability is in the `/forms/{form}/webhooks/{webhook}` endpoint of Deck9 Input v2.0.1. Authorization checks validate access to the `{form}` path parameter, but the `{webhook}` parameter is resolved independently and is not scoped to the parent form — the controller then applies the mutation to this unverified webhook object. [ref_id=1]
What the fix does
The advisory identifies the missing rule as scoped route binding or an explicit check that the webhook belongs to the authorized form before performing the update or delete. The controller's `update()` call (`$webhook->update(...)`) and the delete path both need to scope the webhook resolution to the parent form, ensuring that the supplied `{webhook}` identifier actually belongs to the form used for authorization. [ref_id=1]
Preconditions
- authAttacker must be authenticated and own at least one form (formA) on the Deck9 Input v2.0.1 instance.
- inputAttacker must know the webhook identifier (webhookB) of a webhook belonging to a different tenant's form.
Generated on Jun 15, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.