Access Control Flaw in Convoy's Webhooks Gateway by Frain Dev

CVE-2026-81505

What is CVE-2026-81505?

Convoy, a cloud-native webhooks gateway by Frain Dev, contains an access control issue that enables authenticated users or project-scoped API key holders to bypass project boundaries. Specifically, prior to version 26.6.8, the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint improperly authorizes access solely based on sourceID, failing to verify that it belongs to the specified project. This allows users to query for and obtain another tenant's source information, including sensitive credentials for services such as AMQP, Kafka, SQS, or Google PubSub. Users are strongly advised to upgrade to version 26.6.8 or later to mitigate this risk.

References