Authorization bypass through user-controlled key in Paperclip - #VU141311
Published: August 8, 2026
Vulnerability details
The vulnerability allows a remote user to compromise another tenant, disclose sensitive information, modify data, and cause a denial of service.
The vulnerability exists due to improper access control in the `/agents/:id/keys` routes when handling key management requests for attacker-supplied agent or key identifiers. A remote user can send crafted `GET`, `POST`, or `DELETE` requests to list, create, or revoke agent API keys across tenant boundaries to compromise another tenant, disclose sensitive information, modify data, and cause a denial of service.
The `POST` handler returns a cleartext agent token for the victim company, and the `DELETE` path authorizes by `keyId` without validating that the key belongs to a company accessible to the caller.