CVE-2026-72741
Received Received - Intake

Broken Access Control in Rainbond

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-72741
EUVD
EUVD-2026-58190

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
goodrain rainbond 6.9.7
goodrain rainbond to 6.9.7 (inc)
goodrain rainbond 3.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72741 is an Insecure Direct Object Reference (IDOR) vulnerability in Rainbond through version 6.9.7. It allows authenticated attackers to bypass authorization checks by replacing another enterprise's tenant name in URL paths. Despite having a valid API token, the system fails to verify enterprise ownership, enabling access to unauthorized resources like services, plugins, environment variables, and certificates.

Detection Guidance

To detect this vulnerability, inspect Rainbond API traffic for requests where the tenant_name in the URL path does not match the enterprise ID associated with the API token. Check for unauthorized access attempts to /v2/tenants/{tenant_name}/ endpoints. Monitor logs for repeated failed authorization checks or unusual cross-enterprise resource access patterns.

Impact Analysis

This vulnerability allows attackers to access, modify, or delete resources belonging to other enterprises in a shared multi-tenant environment. Sensitive data such as application services, plugins, environment variables, and certificates could be exposed or altered. The impact includes data breaches, service disruption, and unauthorized changes to critical configurations.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control in standards like GDPR and HIPAA. It enables unauthorized access to sensitive enterprise data, which could result in data breaches, loss of confidentiality, and failure to meet regulatory obligations for data security and access controls.

Mitigation Strategies

Immediately upgrade Rainbond to a version beyond 6.9.7 where this vulnerability is patched. If upgrading is not possible, restrict API token access to specific enterprises by implementing enterprise ID verification in the CheckToken function. Disable or closely monitor multi-tenant API endpoints until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart