Quick answers
- Is CVE-2026-50165 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-50165 being exploited in the wild.
- How severe is CVE-2026-50165?
- Informational severity, published 9 September 2026.
- Which products and versions are affected?
- Alf.Io <2.0-M5-2606.
- Is there a fix for CVE-2026-50165?
- A patch was published on 2026-06-02: Version 2.0-M5-2606 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-50165 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-50165?
- Check whether you run Alf.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper access control flaw (CWE-284) in organization/event-scoped configuration endpoints that accept an arbitrary configuration key parameter. Although the endpoints correctly require organization or event ownership, they perform a lookup that includes system-level configuration alongside organization-level configuration and return the first matching key—allowing the lookup to escape the intended scope. An authenticated organization owner can abuse this by requesting system secrets like SYSTEM_API_KEY, SMTP_PASSWORD, or payment processor credentials through endpoints like /admin/api/configuration/organizations/{organizationId}/single/{KEY}. If SYSTEM_API_KEY is exposed, the attacker can chain this into further API abuse to mint API keys for other organizations or perform administrative operations. The fix was released in version 2.0-M5-2606, which restricts the configuration lookup to organization-scoped values only.
Affected products
- alf.io alf.io <2.0-M5-2606
Timeline
- 2026-06-02: disclosed
- 2026-06-02: patched: Version 2.0-M5-2606 released