Improper Authorization in Paperclip - #VU141308
Published: August 8, 2026
Vulnerability details
The vulnerability allows a remote user to bypass cross-tenant authorization and mint an agent API token to gain unauthorized access to another company's data and agent operations.
The vulnerability exists due to improper authorization in the /api/agents/:id/keys, /api/agents/:id/keys/:keyId, and related agent lifecycle handlers when handling requests for agent key management and agent actions without verifying company membership. A remote user can send a specially crafted request targeting an agent ID in another company to bypass cross-tenant authorization and mint an agent API token to gain unauthorized access to another company's data and agent operations.
Exploitation requires the application to run in authenticated mode, and user interaction is not required.