CVE-2026-92764

Overview

OpenCVE versions prior to 3.1.0 incorrectly expose the organization memberships of the token creator when querying the organizations API. An attacker with an organization‑scoped token can enumerate and retrieve all organizations the token creator belongs to, bypassing intended isolation.

Description

OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries.

Impact

{'confidentiality': 'High – attacker gains visibility into all organizations the token creator is a member of, potentially revealing sensitive project or customer data.', 'integrity': 'None – no modification of data or configuration.', 'availability': 'None – no denial of service impact.'}

Remediation

['Upgrade to OpenCVE 3.1.0 or later where the organizations endpoint is correctly scoped to the token’s organization.', 'If an upgrade is not immediately possible, restrict the use of organization‑scoped tokens to trusted users and monitor API calls for anomalous enumeration patterns.', 'Apply the principle of least privilege: issue tokens with only the scopes required for the intended operation.', 'Consider temporarily disabling the organizations API for users with organization‑scoped tokens until the patch is applied.', 'Validate that the API returns only the organizations associated with the token’s own organization and not the creator’s memberships.']

Risk context

The vulnerability has a medium CVSS v3 score (4.3) and a CVSS v4 score (5.3). While it does not affect availability or integrity, it allows significant confidentiality exposure. Prompt patching or mitigation is recommended to prevent unauthorized disclosure of organizational membership data.

Affected products

• OpenCVE
• OpenCVE 3.0.x
• OpenCVE <3.1.0