CVE-2026-108718 Details
Description
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.
A missing authorization vulnerability has been identified in the Rill admin OAuth server, specifically in versions 0.77.0 through 0.90.5. This vulnerability allows dynamically registered clients to obtain authorization codes without user consent. Attackers can exploit this by registering a client with the 'long_lived_access_token' scope and enticing a user to click an authorization link, resulting in the acquisition of a non-expiring API token that carries the user's full permissions.
To address this vulnerability, implement authentication or an allowlist for the dynamic client registration endpoint. Additionally, gate the 'long_lived_access_token' scope on a server-side allowlist of trusted clients, and add a consent step before issuing authorization codes for non-trusted clients.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Rill | >= 0.77.0, <= 0.90.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |