Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus

Advisories

Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus

Severity: low
Date: 11/10/2026
Affecting: Meteroid >= 0, < 2.2.0
CVE: CVE-2026-125752
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 2.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
References: https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2
Meteroid v2.2.0 Release Notes
https://github.com/meteroid-oss/meteroid/blob/v2.1.0/modules/meteroid/crates/diesel-models/src/query/coupons.rs#L472-L486
https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor
Credit: hieuPenguinnn
Description: Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo