Broken Authorization in Tamery Cloud Sync API by Wannabe Space

CVE-2026-119663

What is CVE-2026-119663?

Tamery, previously known as Conar, versions prior to 0.99.0, possess a vulnerability in the cloud synchronization API. Specifically, the issue lies within the connectionsResources.create handler, which allows authenticated users to improperly attach resources to the connections of other users. An attacker with access to one connection can exploit this flaw by including a victim's connectionId in a batch request, leading to unauthorized insertion of resource rows under the victim's user context.

References