CVE-2026-80209
Received Received - Intake

Authentication Bypass in Fonoster Workspace Renaming

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues into prisma.workspace.update, which is scoped by the workspace reference alone, so the rename commits before the second callback is issued and the caller receives a permission error for a write that already succeeded. The gRPC interceptor in mods/common/src/identity/createAuthInterceptor.ts binds the workspace accessKeyId to the caller's token only for paths in workspaceResourceAccess or workspaceResourceOwnerOrAdminAccess, and Identity/UpdateWorkspace is listed in fullIdentityAccess, which the base USER role holds. Any authenticated user can therefore rename an arbitrary workspace in the deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-09-17
AI Q&A
2026-08-27
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80209
EUVD
EUVD-2026-67143

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fonoster fonoster 0.22.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-80209 is an authorization bypass in Fonoster's Identity/UpdateWorkspace module. When a user tries to rename a workspace they are not a member of, the system issues a PERMISSION_DENIED error but fails to stop execution. This allows the rename operation to proceed via prisma.workspace.update, which only checks the workspace reference, not membership. Any authenticated user can exploit this to rename any workspace in the system.

Detection Guidance

To detect this vulnerability, check Fonoster logs for unauthorized workspace rename attempts. Look for gRPC calls to Identity/UpdateWorkspace from non-members. Verify if prisma.workspace.update operations occur without proper membership validation. Check for PERMISSION_DENIED errors followed by successful updates in logs.

Impact Analysis

This vulnerability allows any authenticated user to rename workspaces they do not own or have access to. This could lead to unauthorized modifications of workspace names, potential confusion or disruption in collaborative environments, and possible data integrity issues if renamed workspaces are misidentified.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized users to modify workspace names, potentially violating access control requirements in GDPR (Article 32) and HIPAA (Security Rule). Unauthorized changes may compromise data integrity and access logging, which are critical for audit trails and regulatory reporting.

Mitigation Strategies

Immediately upgrade Fonoster to a patched version. Temporarily restrict workspace rename permissions to workspace members only. Review and update gRPC interceptor rules to enforce workspace access key binding for UpdateWorkspace operations. Monitor logs for suspicious rename activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart