Vulnerability · Published Jul 28, 2026 · Assigned by VulnCheck

CVE-2026-57510SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in superplane from superplanehq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 49.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

Affected products (as reported)

Vendor	Product	Versions
superplanehq	superplane	0 – before 0.27.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/superplane-broken-object-level-authorization-via-canvasservice-grpc third-party-advisory