Incorrect authorization in Corteza - #VU156183
Published: October 19, 2026
Vulnerability identifier: #VU156183
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to falsify workflow or trigger ownership attribution.
The vulnerability exists due to missing authorization checks in Corteza's workflow and trigger OwnedBy handling when processing ownership assignments during creation or updates. A remote user can supply an unauthorized OwnedBy value to attribute a workflow or trigger to another user.
Affected software
Corteza
Remediation
Install security update from vendor's website.
Corteza - update to 2026.9.0