CVE-2026-80049
Received Received - Intake

Authorization Bypass in Airbyte Platform Workspace Handling

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults X-Airbyte-Workspace-Id ahead of every resource-derived header, including those for connection, source and destination identifiers. Endpoints whose declared request bodies carry only a resource identifier are nonetheless reached with an added workspaceId field, because the extractor reads the body rather than the endpoint's schema, so the permission check is performed against the workspace the caller nominated while the handler acts on the resource identifier the caller supplied. Nothing afterwards compares the resource's owning workspace with the one that was authorized. A member of any workspace can therefore read source and destination configuration, trigger and cancel syncs, and delete connections, sources and destinations that belong to workspaces they have no access to, at whatever privilege level their own workspace membership grants them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-26
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-80049
EUVD
EUVD-2026-65701

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
airbyte platform to 2.0.0 (exc)
airbyte platform 2.0.0
airbyte platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-80049 is an Insecure Direct Object Reference (IDOR) vulnerability in the Airbyte Platform API server. It allows authenticated workspace members to bypass authorization checks and perform unauthorized actions on resources belonging to other workspaces. The issue occurs because the platform resolves the workspace for authorization from a caller-supplied field instead of the resource itself, leading to a mismatch between the authorized workspace and the resource being accessed.

Detection Guidance

To detect this vulnerability, inspect HTTP requests to Airbyte Platform endpoints for unauthorized workspaceId fields in request bodies. Check logs for requests to /connections/sync, /sources/delete, or /destinations/delete with mismatched workspace headers. Use network monitoring tools to identify requests where X-Airbyte-Workspace-Id does not match the resource's actual workspace.

Impact Analysis

This vulnerability enables unauthorized users to read configuration details of sources and destinations in other workspaces, delete connections, sources, and destinations, and trigger or cancel syncs on connections they do not own. The impact depends on the attacker's workspace role, such as WORKSPACE_READER, WORKSPACE_EDITOR, or WORKSPACE_RUNNER.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's access controls. Unauthorized users could read configurations, trigger data syncs, or delete resources across workspaces, risking data breaches and non-compliance with privacy regulations.

Mitigation Strategies

Immediately upgrade Airbyte Platform to a patched version. Temporarily restrict access to sensitive endpoints like /connections/sync, /sources/delete, and /destinations/delete. Review logs for suspicious cross-workspace activity. Implement strict input validation to ensure workspaceId matches resource ownership before processing requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80049. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart