{"id":"CVE-2026-110768","title":"holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id","summary":"holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-290"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T19:17:12.763","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110768","references":[{"url":"https://github.com/holaboss-ai/holaOS","label":"disclosure@vulncheck.com"},{"url":"https://github.com/holaboss-ai/holaOS/blob/4684714ee133794cdbb86630e42b7d93447fb2e2/runtime/channel-gateway/src/connectors/telegram.ts#L491","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieuPenguinnn/holaos-channel-gateway-allow-all-sender-default","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/holaos-through-2026.822.1-authorization-bypass-via-telegram-connector-username-allowlist","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-10-14T19:49:57.611Z","slug":"CVE-2026-110768","body":"## Overview\n\nholaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}