Authorization Bypass in Meteroid API Token Service by Meteroid

CVE-2026-125751

What is CVE-2026-125751?

Meteroid versions prior to 2.2.0 are susceptible to an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler. This flaw fails to properly enforce the caller's tenant context, allowing authenticated users with 'settings:read' permission to exploit the vulnerability. By supplying an API token ID belonging to another tenant, an attacker can retrieve that tenant's Argon2 secret hash and its owning tenant ID, potentially leading to unauthorized access to sensitive information across tenant boundaries.

References