PT-2026-52541 · Getmaxun · Maxun

George Chen · Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-56767

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-56767

Affected Products

Maxun

References · 5

• https://github.com/getmaxun/maxun/commit/11db0257531f1c23dec94727793c9444ee2873cf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-56767 · Security Note
• https://github.com/getmaxun/maxun/issues/1079 · Note
• https://github.com/getmaxun/maxun/pull/1088 · Note
• https://vulncheck.com/advisories/maxun-cross-tenant-idor-in-storage-and-webhook-api-handlers · Note