CVE-2026-57956 Details
Description
SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.
A broken access control vulnerability has been identified in SigNoz versions through 0.130.1. This vulnerability allows authenticated users to access alert rules of other organizations by providing a specific rule UUID. The issue arises because the alert rule storage does not filter by organization ID, enabling unauthorized access. Attackers can read, edit, and delete alert rules from other organizations, exploiting the lack of tenant isolation and bypassing multi-tenant access controls.
It is recommended to add organization ID checks to the rule store predicates and to audit the rule-history endpoints to ensure proper access controls are enforced.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SigNoz/signoz/issues/11830 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/SigNoz/signoz/issues/11830 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/SigNoz/signoz/pull/12117 | [email protected] | |
| https://github.com/SigNoz/signoz/releases/tag/v0.133.0 | [email protected] | |
| https://www.vulncheck.com/advisories/signoz-cross-organization-insecure-direct-object-reference-in-alert-rules | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SigNoz | <= 0.130.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | [email protected] |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |