Improper Handling of Case Sensitivity in Corteza - #VU164416
Published: November 10, 2026
Vulnerability identifier: #VU164416
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to reconstruct restricted field values in records they can otherwise search and read.
The vulnerability exists due to inconsistent case-sensitive field-name resolution between permission validation and query execution in the Corteza Compose record-listing API when processing filter and sort parameters. A remote user can reference protected fields using different capitalization in query or sort parameters and repeatedly probe LIKE prefix matches with boolean AND to reconstruct hidden values despite response redaction.
Affected software
Corteza
Remediation
Install security update from vendor's website.
Corteza - update to 2026.9.0