Medium severity4.3NVD Advisory· Published Sep 16, 2026· Updated Sep 23, 2026

CVE-2026-92764

Description

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Opencve/Opencvereferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <3.1.0

Patches

Vulnerability mechanics

References

github.com/opencve/opencve/issues/744nvd
github.com/opencve/opencve/releases/tag/v3.1.0nvd
github.com/opencve/opencve/security/advisories/GHSA-xvpw-4gpp-w7h7nvd
www.vulncheck.com/advisories/opencve-organization-api-ignores-token-scopenvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000