CVE-2026-125752

CVE-2026-125752CVE-2026-125752

Description

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.

Scoring

CVSS 5.0 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Last modified2026-11-10
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.