HIGH

CVE-2026-57510

2026-07-28 CVSS v3.1

CVSS

8.8

Description

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

Weakness (CWE)

CWE-639 Authorization Bypass (IDOR)

EPSS Score

0.34%

Probability of exploitation in next 30 days

27.3th percentile

References

https://github.com/superplanehq/superplane/commit/3e45cf4f1b5f1be9fbbfd90c97960a73f00f897b https://github.com/superplanehq/superplane/pull/5635 https://github.com/superplanehq/superplane/releases/tag/v0.27.0 https://www.vulncheck.com/advisories/superplane-broken-object-level-authorization-via-canvasservice-grpc

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE