Executive brief
OpenCVE is a vulnerability tracking platform that uses organization-scoped API tokens to limit third-party tools and integrations to a single organization. A flaw in versions 2.4.0 through 3.0.x allows these tokens to list and retrieve metadata (names, IDs, timestamps) for all organizations their creator belongs to, breaking intended access isolation. An attacker with a token meant for organization A could discover all unrelated organizations the token creator participates in.
Technical details
The vulnerability is a broken authorization scope in the OrganizationViewSet REST endpoint. During organization-scoped token authentication, the request.user is set to the token creator and request.authenticated_organization is set to the token's intended organization. However, the OrganizationViewSet.get_queryset() method filters results by Organization.objects.filter(members=request.user), using the creator's memberships instead of the token's authenticated_organization. This bypasses the per-organization isolation that sibling endpoints (ProjectViewSet) correctly implement. The flaw affects both list (GET /api/organizations) and retrieve (GET /api/organizations/<name>) operations. No user interaction or additional privileges are required; any holder of an organization-scoped token can trigger the enumeration. The vulnerability was fixed in version 3.1.0, which introduced REST API v2 with proper token scoping and project-level access control.
Affected products
- OpenCVE OpenCVE 2.4.0 through 3.0.x
Timeline
- 2026-06-21: disclosed: Issue #744 reported on GitHub
- 2026-09-16: advisory: CVE-2026-92764 published
- 2026-08-14: patched: Fixed in OpenCVE v3.1.0