Authorization Bypass in CLA Assistant Admin API

CVE-2026-89112

What is CVE-2026-89112?

The CLA Assistant's admin API endpoint, which retrieves CLA signature records, lacks consistent authorization checks when specifying an organisation via the organisation ID. This oversight allows authenticated users with limited privileges to potentially access sensitive contributor information from organisations they do not have the authority to manage, exposing critical data and breaching confidentiality.

References