CVE-2026-15630

Deferred Deferred - Pending Action

Authorization Bypass in Multi-Tenant Platform via ID Parameter Manipulation

Publication date: 2026-07-23

Last updated on: 2026-07-30

Assigner: CERT/CC

Description

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-30

Generated

2026-08-13

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-11

NVD

CVE-2026-15630

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability allows a non-global organization admin in one tenant to bypass tenant boundaries. By exploiting a mismatch between authorization checks (based on ?id= parameter) and the action performed (based on request body), they can delete, create, or modify resources in any other tenant.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access and manipulation of resources across different tenants. This may result in data loss, unauthorized modifications, or disruption of services in affected tenants.

Compliance Impact

This vulnerability allows unauthorized access and modification of resources across tenant boundaries, which could lead to unauthorized data exposure or manipulation. This may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Implement strict tenant boundary checks in authorization logic to ensure actions are validated against the correct tenant ID. Review and update access controls to prevent cross-tenant modifications. Audit all admin actions for unauthorized resource changes across tenants.

Hi! I’m here to help you understand CVE-2026-15630. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70