Broken Object-Level Authorization in SuperPlane

Executive Summary

This vulnerability is a broken object-level authorization flaw in SuperPlane before version 0.27.0. It exists in the CanvasService gRPC handlers and allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without proper organization scoping.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SuperPlane instance is running a version before 0.27.0. Verify the gRPC CanvasService handlers for improper organization scoping in canvas or queue UUID handling. Monitor for unauthorized cross-tenant access attempts or unusual activity in execution history and event payloads.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to read sensitive secrets from cross-tenant execution history and event payloads, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized cross-tenant access to sensitive data, including execution history and secrets. This could violate GDPR's data protection requirements (Article 32) and HIPAA's safeguards for protected health information by enabling unauthorized access to sensitive data across organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SuperPlane to version 0.27.0 or later to patch the vulnerability. Review and restrict user permissions to ensure least privilege access. Monitor network traffic for unauthorized gRPC requests to CanvasService handlers. Audit cross-tenant data access logs for suspicious activity.

Useful 0 Not Useful 0