CVE-2026-125751

EUVD-2026-121233
Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash and owning tenant ID.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/meteroid-oss/meteroid/blob/v2.1.0/modules/meteroid/crates/meteroid-api/src/apitokens/service.rs#L78-L101
https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2
https://github.com/meteroid-oss/meteroid/releases/tag/v2.2.0
https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor
https://www.vulncheck.com/advisories/meteroid-before-2.2.0-cross-tenant-api-token-hash-disclosure-via-getapitokenbyid