Executive brief
Deck9 Input, a form management platform, contains a security flaw that allows users to modify or delete webhooks belonging to other organizations. By sending a specially crafted request, an authenticated user can redirect data streams, disable notifications, or delete integration settings for forms they do not own. This could lead to data being sent to malicious servers or significant disruptions in automated business workflows.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Deck9 Input v2.0.1 within the `/{form}/webhooks/{webhook}` endpoint. The application performs authorization checks on the `{form}` parameter but fails to verify that the `{webhook}` object actually belongs to that specific form. Because the webhook model is resolved independently of the parent form, an authenticated attacker can provide a form ID they own and a target webhook ID they do not own to perform unauthorized updates or deletions. This results in cross-tenant integrity loss and availability issues for webhook integrations.
Affected products
- Deck9 Input 2.0.1
Timeline
- 2026-06-13: disclosed: Initial discovery and Gist publication
- 2026-06-15: advisory: CVE published to NVD dataset