Cross-Tenant Authorization Bypass Vulnerability in Meteroid by Meteroid OSS
CVE-2026-125752

2.3LOW

Key Information:

Vendor

Meteroid-oss

Status
Meteroid
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125752?

Meroid versions prior to 2.2.0 are vulnerable to a cross-tenant authorization bypass due to flawed filtering in the CouponsService UpdateCouponStatus gRPC handler. This vulnerability permits authenticated users, equipped with catalog:manage permissions or tenant-scoped API keys, to manipulate coupons belonging to other tenants by providing arbitrary coupon IDs, thereby enabling unauthorized actions such as disabling, archiving, or re-enabling these coupons and retrieving their details.

Affected Version(s)

Meteroid 0 < 2.2.0

References

https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2b...
patch
https://github.com/meteroid-oss/meteroid/releases/tag/v2.2.0
release-notes
https://github.com/meteroid-oss/meteroid/blob/v2.1.0/modu...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.