CVE-2026-6355 Details
Description
A vulnerability in the web application allows unauthorized users to access and manipulate sensitive data across different tenants by exploiting insecure direct object references. This could lead to unauthorized access to sensitive information and unauthorized changes to the tenant's configuration.
A vulnerability exists in the Augmentt web application that allows unauthorized users to access and manipulate sensitive data across different tenants. This issue arises from insecure direct object references, which can lead to unauthorized access to sensitive information and unauthorized modifications of a tenant's configuration. The vulnerability affects an unknown version of the Augmentt web application, released prior to October 2025.
It is recommended that the backend perform mandatory checks before processing requests that include external identifiers like 'customerid'. These checks should ensure that the authenticated user's ID is authorized to access the specified resource ID. If the user ID does not match the resource owner's ID, the server should reject the request and return a generic error, such as HTTP 404 Not Found or HTTP 403 Forbidden.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Penguinsecq/CVE-2026-6355/ | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| augmentt augmentt | < 2025-10-02 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |