CVE-2026-81505 Details
Description
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.
A cross-tenant IDOR vulnerability has been identified in Convoy, a cloud-native webhooks gateway, affecting versions prior to 26.6.8. The issue arises in the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint, where the authorization check only verifies if the caller has access to the project specified in the URL. However, the source lookup is performed without confirming that the source belongs to the authorized project. This flaw allows an authenticated user or project-scoped API key holder to access source records from other projects, including unredacted message broker credentials for AMQP, Kafka, SQS, or Google PubSub.
Users can update to Convoy version 26.6.8 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/frain-dev/convoy/commit/1cc67cd16fb1f8890cc83a3998d3f92dceb7fd06 | [email protected] | Source CodeVendor |
| https://github.com/frain-dev/convoy/pull/2755 | [email protected] | Issue TrackingVendor |
| https://github.com/frain-dev/convoy/releases/tag/v26.6.8 | [email protected] | Release NotesVendor |
| https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| frain-dev/convoy | < 26.6.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |