Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck
CVE-2026-56767Maxun < 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlers
High 8.8
In plain English
A high-severity missing authorization in maxun from getmaxun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 51.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue technical-description
- Pull Request issue-tracking
- Patch Commit patch
- https://www.vulncheck.com/advisories/maxun-cross-tenant-idor-in-storage-and-webhook-api-handlers third-party-advisory