{"id":"CVE-2026-92764","title":"OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships","summary":"OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve ev…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-863"],"vendor":"opencve","product":"opencve","affected":["opencve >= 2.4.0 < 3.1.0"],"published":"2026-09-16","updated":"2026-09-23","sourceUpdated":"2026-09-23T19:19:44.587","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92764","references":[{"url":"https://github.com/opencve/opencve/issues/744","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opencve/opencve/releases/tag/v3.1.0","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opencve/opencve/security/advisories/GHSA-xvpw-4gpp-w7h7","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/opencve-organization-api-ignores-token-scope","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opencve/opencve","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opencve/opencve/blob/v2.4.0/web/organizations/resources.py#L20-L25","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opencve/opencve/blob/v3.1.0/web/organizations/resources.py#L20-L30","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/opencve-before-3.1.0-organization-api-ignores-token-scope","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-21T16:22:41.067134Z"},"epss":0.00298,"epssPercentile":0.22673,"ingestedAt":"2026-09-16T21:05:36.895Z","slug":"CVE-2026-92764","body":"## Overview\n\nOpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}