PT-2026-36630 · Npm · @Saltcorn/Data

Published 2026-04-22 · Updated 2026-04-22

OSV

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Summary

When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can simply append /tenant/create to their tenant URL. The system reads the role from the tenant context (admin), and a new tenant is created on the root domain (in PUBLIC SCHEMA > sc tenants), rather than in the tenant's own sc tenants table.

If the same logic applies to other routes, a tenant admin effectively gains admin rights on the root domain.

PoC

A tenant-created subtenant appears under the Saltcorn public schema instead of the tenant's own schema.

• Even when role id=1 is required for tenant creation on saltcorn.com (only admin can create tenants), existing tenant admins can still create new tenants because their local role id:1 is evaluated against the root domain.
• Even when role to create tenant is set to 0 in the tenant's sc config schema, or removed entirely, the tenant admin can still create sub-tenants on the root domain — suggesting role to create tenant is not being read at all.

Impact

Tenant admins gain unauthorized admin-level access to the root domain. Any authenticated tenant admin can perform privileged operations (e.g., creating tenants) on the root domain by exploiting the role context mismatch.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

GHSA-9237-RG5P-RHFW

Affected Products

@Saltcorn/Data

References · 3

• https://osv.dev/vulnerability/GHSA-9237-rg5p-rhfw · Vendor Advisory
• https://github.com/saltcorn/saltcorn/security/advisories/GHSA-9237-rg5p-rhfw · Note
• https://github.com/saltcorn/saltcorn · Note