Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-72741Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access

High 8.1

In plain English

A high-severity authorization bypass via user-controlled key in rainbond from goodrain. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 82.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates.

Affected products (as reported)

Vendor	Product	Versions
goodrain	rainbond	0 – through 6.9.7

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Researcher Disclosure technical-description, exploit, issue-tracking
https://www.vulncheck.com/advisories/rainbond-region-api-cross-enterprise-idor-via-tenant-access third-party-advisory