Executive brief
Fonoster is an open-source telephony platform that manages workspaces and user access. An authentication flaw allows any logged-in user to rename workspaces they do not own or belong to. The application checks permissions but fails to block the operation, leaving the workspace renamed even though the user receives a permission denial, enabling account takeover and business disruption.
Technical details
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts contains a logic error: it invokes a gRPC callback with PERMISSION_DENIED when createIsWorkspaceMember reports the caller is not a workspace member, but does not return, allowing execution to continue into the prisma.workspace.update call. The workspace update commits before the second callback is issued, so the rename succeeds even though the client receives a permission error. The gRPC interceptor in mods/common/src/identity/createAuthInterceptor.ts does not enforce workspace scoping for Identity/UpdateWorkspace (listed in fullIdentityAccess rather than workspace-restricted paths), allowing any authenticated user with the base USER role to trigger this flow. Network-reachable; authentication required; affects Fonoster through version 0.22.7.
Affected products
- Fonoster Fonoster through 0.22.7
Timeline
- 2026-08-27: disclosed