Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck

CVE-2026-57956SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules

Medium 6.4

In plain English

A medium-severity authorization bypass via user-controlled key in signoz from SigNoz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.4%top 70.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.

Affected products (as reported)

Vendor	Product	Versions
SigNoz	signoz	0 – before 0.133.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

References

Researcher Disclosure issue-tracking
Release Notes release-notes
Pull Request issue-tracking
https://www.vulncheck.com/advisories/signoz-cross-organization-insecure-direct-object-reference-in-alert-rules third-party-advisory