SB2026101951 - Multiple vulnerabilities in Corteza

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101951

SB2026101951 - Multiple vulnerabilities in Corteza

Published: October 19, 2026

Security Bulletin ID SB2026101951
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 23% Low 77%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in other users' browser sessions, disclose sensitive information, and perform unauthorized actions with the victims' privileges, including administrative privileges.

The vulnerability exists due to improper output neutralization in Corteza's xss.RichText function when decoding HTML entities after sanitization, combined with the Compose Calendar block rendering stored event titles through innerHTML. A remote user can create a record with an attacker-writable Calendar title field containing <img src=x onerror=alert(window.__xss=document.domain)> to persist executable HTML that runs in a victim's browser when the victim opens the Calendar page.


2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite other users' reminders, causing loss of access to the reminders and preventing their scheduled notifications from being delivered.

The vulnerability exists due to incorrect authorization in Corteza's ReminderService.Update when processing reminder updates: authorization checks the caller-supplied object rather than ownership of the stored reminder. A remote attacker can send PUT /system/reminder/{reminderID} with an empty JSON body {} for a known reminder ID to reassign the reminder to user 0, erase its payload and resource, and clear its scheduled time because the omitted assignedTo and the anonymous identity both default to 0.


3) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: N/A)

CWE-ID: CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to predict security tokens and secrets, potentially gaining unauthorized access to accounts and protected information.

The vulnerability exists due to use of cryptographically weak pseudorandom number generators in Corteza's security-token generation routines when generating password-reset, invitation, email-confirmation, and other security-sensitive values. A remote user can use observed generator outputs or guessable initialization values to attempt to predict valid tokens and secrets, potentially compromising account confidentiality and integrity.


4) Information Exposure Through Timing Discrepancy (CVE-ID: N/A)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to potentially infer credential-token values through timing differences and gain unauthorized access to accounts.

The vulnerability exists due to a non-constant-time string comparison in loadUserFromToken() in server/system/service/auth_credentials.go when validating submitted credential tokens against stored values. A remote user can submit candidate tokens and analyze possible response-time differences to infer valid token values, potentially compromising account confidentiality and integrity.


5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to impersonate an arbitrary valid user and perform unauthorized operations with that user's privileges, including reading, modifying, or deleting records.

The vulnerability exists due to missing authorization checks in Corteza's automation workflow service when processing client-supplied RunAs values during workflow creation or updates. A remote privileged user can set RunAs to an administrator's user ID and enable a workflow with an event or interval trigger to execute automation actions under the administrator's identity without a subsequent execute-permission check.


6) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to falsify workflow or trigger ownership attribution.

The vulnerability exists due to missing authorization checks in Corteza's workflow and trigger OwnedBy handling when processing ownership assignments during creation or updates. A remote user can supply an unauthorized OwnedBy value to attribute a workflow or trigger to another user.


7) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read and delete file attachments belonging to otherwise inaccessible records, pages and namespaces across the instance.

The vulnerability exists due to missing object-level authorization in the Corteza Compose attachment service and its Read, Delete, Original and Preview endpoints when handling attachment identifiers supplied in requests. A remote user can submit requests referencing another workspace's attachment identifiers to retrieve attachment metadata and signed download URLs, download file contents and delete attachments without permission to access their parent resources.


8) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote privileged user to disclose sensitive information from internal services and cloud metadata endpoints accessible from the Corteza server.

The vulnerability exists due to missing destination address validation in the automation workflow engine's httpRequestHandler.send() function when processing caller-supplied URLs in HTTP Request steps. A remote privileged user can execute an authorized workflow with a specially crafted destination URL to send requests to internal services and retrieve the full response, including its status, headers, and body, to disclose sensitive information such as cloud credentials and internal API data.


9) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to download private Compose record attachments and disclose sensitive information.

The vulnerability exists due to authorization bypass through an attacker-controlled kind parameter in the Compose attachment-serving component when handling attachment download requests. A remote attacker can request a private attachment by its identifier with kind=page to bypass the signature check and download its contents, because the lookup does not validate the attachment's stored kind or namespace against the request.


10) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read or delete attachments without authorization.

The vulnerability exists due to missing authorization checks in the Compose attachment service's FindByID, Read, and DeleteByID operations when handling attachment access by identifier. A remote user can supply another attachment's identifier to access its contents or delete it without the intended access-control checks.


11) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain signed download URLs for attachments they are not authorized to read.

The vulnerability exists due to apparently inverted authorization checks in the Compose attachment service's Find and List guards when evaluating attachment read permissions. A remote user can invoke the affected operations while denied read access to obtain signed download URLs that may permit unauthorized access to attachment contents.


12) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges by acquiring unintended contextual roles and read, create, modify, or delete protected Compose records, depending on the acquired role's grants.

The vulnerability exists due to authorization decisions based on user-controlled profile attributes in Corteza's contextual-role RBAC engine when evaluating role membership expressions. A remote user can send a crafted PUT request to /system/users/{ownID} to change their own email, username, handle, name, or labels to satisfy a contextual-role expression and obtain that role's permissions.


13) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute role-restricted Corredor server scripts and invoke privileged business logic with controlled arguments.

The vulnerability exists due to incorrect authorization in Corredor's serverScriptSecurity and canExec functions when handling explicit onManual server script execution requests. A remote user can submit script and args fields to POST /api/system/automation/trigger or POST /api/compose/automation/trigger to execute a registered script for the matching resource type despite not belonging to its security.allow roles, provided no security.deny entry blocks the user's roles.

For restricted scripts configured with runAs, enabling CORREDOR_RUN_AS_ENABLED causes execution with the configured runner context and generation of an authToken for that runner.


Remediation

Install update from vendor's website.

References