Authorization Flaw in Ideon Visual Workspace Allows Unauthorized Write Operations
CVE-2026-65965

8.7HIGH

Key Information:

Vendor

3xpyth0n

Status
Ideon
Vendor
CVE Published:
11 November 2026

What is CVE-2026-65965?

Prior to version 0.9.4, Ideon, a self-hosted visual workspace, inadvertently allowed users with a read-only viewer role to execute unauthorized write operations on projects. Through several project mutation endpoints, specifically the POST request to /api/projects/[id]/graph, a viewer could erase and modify the entire project canvas. This oversight permits unauthorized modification of project data, undermining the integrity of user permissions. This issue has been effectively addressed in version 0.9.4, where appropriate role enforcement measures were implemented.

Affected Version(s)

ideon < 0.9.4

References

https://github.com/3xpyth0n/ideon/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/3xpyth0n/ideon/commit/ed58ca7a70543c7f...
x_refsource_MISC
https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.