CVE-2026-77170

Overview

An access control vulnerability exists in the Deck config API that permits authenticated users to modify board-scoped configuration keys for arbitrary board IDs. The issue stems from a lack of validation regarding whether the user owns or holds permissions to manage the targeted board. This matters because it enables unauthorized configuration tampering across organizational boundaries within the application.

Description

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.

Impact

This vulnerability primarily impacts the integrity of board configurations, potentially allowing unauthorized users to alter settings for boards they do not control. Confidentiality and availability impacts are generally limited, though incorrect configurations could disrupt user workflows. Organizations utilizing the affected software are at risk of internal data tampering by low-privileged authenticated users. The overall impact is bounded by the application's access control enforcement boundaries.

Remediation

Apply the latest security patches or updates provided by the vendor to resolve authorization checks within the config API. Implement rigorous server-side validation to verify that the authenticated user possesses explicit ownership or management permissions for the requested board ID prior to processing configuration changes. Conduct an audit of current board configurations and access control lists to detect any unauthorized modifications.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 4.3, and EPSS data is currently not available. Since exploitation requires authenticated access, urgency is moderate, but remediation should still be prioritized during standard maintenance cycles to maintain proper data integrity and access control hygiene.

Affected products

• Deck Config API
• Deck Application