Executive brief
Identrail is a GitHub integration platform that connects organizations' GitHub repositories to perform security scans and posture assessments. An authenticated attacker can exploit a missing authorization check in the GitHub App connection flow to link a victim organization's GitHub App installation to their own workspace, thereby gaining unauthorized read access to the victim's private repositories and metadata. An attacker needs only a valid Identrail account and knowledge of a target's GitHub App installation ID (which are publicly enumerable) to access sensitive code and repository information.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) / missing authorization (CWE-862, CWE-639) in Identrail's GitHub App connection completion endpoint (`POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete`). The `installation_id` is read from the JSON body or the `X-GitHub-Installation-ID` header without verification. While the `state` parameter is rigorously bound to the caller's tenant/workspace/project scope and re-checked at completion, the `installation_id` is persisted as-is with only a check for `<= 0`. An attacker with valid Identrail credentials can call the completion endpoint with their own valid `state` and a victim's `installation_id` (installation IDs are publicly enumerable integers appearing in GitHub redirect URLs and webhook payloads); the endpoint accepts it, and the attacker can then mint GitHub App access tokens for the victim's installation via the `ListInstallationRepositories` function, gaining read access to victim private repositories. Requires network access and valid authentication; no user interaction needed. Patch available in version 1.0.2.
Affected products
- Identrail Identrail < 1.0.2
Timeline
- 2026-06-20: disclosed: GitHub Advisory Database published (CVE-2026-59185)
- 2026-09-09: advisory: Advisory updated and reviewed
- 2026-09-09: patched: Fix released in version 1.0.2