High severity8.8NVD Advisory· Published Jun 25, 2026· Updated Jul 14, 2026
CVE-2026-56767
CVE-2026-56767
Description
Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints.
Affected products
1Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.