Executive brief
SigNoz is an open-source observability platform used by organizations to monitor application performance and set up alerts. A security flaw in its multi-tenant architecture allows a user from one organization to view, modify, or delete the alert rules of another organization. This could lead to the exposure of sensitive monitoring configurations or the unauthorized silencing of critical system alerts, potentially disrupting operations.
Technical details
A broken access control vulnerability (Insecure Direct Object Reference) exists in SigNoz through version 0.130.1. The root cause is located in the alert rule store predicates (specifically within pkg/ruler/rulestore/sqlrulestore/rule.go), which fail to include organization ID (org_id) filters when performing Get, Edit, or Delete operations. An authenticated attacker with access to one tenant can manipulate the rule UUID in API requests to interact with rules belonging to other tenants. This allows for unauthorized cross-organization reading, modification, and deletion of alert rules in multi-tenant deployments. The vulnerability affects Cloud, Enterprise, and multi-org self-hosted instances, while single-tenant OSS instances are functionally unaffected.
Affected products
- SigNoz SigNoz through 0.130.1
Timeline
- 2026-06-13: disclosed: Initial researcher report to vendor via email
- 2026-06-23: other: Public GitHub issue opened
- 2026-06-29: advisory: NVD publication date