Incorrect authorization in Corteza - #VU156182
Published: October 19, 2026
Vulnerability identifier: #VU156182
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to impersonate an arbitrary valid user and perform unauthorized operations with that user's privileges, including reading, modifying, or deleting records.
The vulnerability exists due to missing authorization checks in Corteza's automation workflow service when processing client-supplied RunAs values during workflow creation or updates. A remote privileged user can set RunAs to an administrator's user ID and enable a workflow with an event or interval trigger to execute automation actions under the administrator's identity without a subsequent execute-permission check.
Affected software
Corteza
Remediation
Install security update from vendor's website.
Corteza - update to 2026.9.0