CyberRota Analysis
AI-GeneratedThe vulnerability affects the Taubyte Tau v1.1.10 service on GitHub, allowing any authenticated user to read or delete projects belonging to other tenants by exploiting the GET and DELETE /projects/{id} endpoints without proper authorization checks. This could lead to unauthorized access and potential data loss across tenant projects. Organizations using this service should prioritize immediate remediation to prevent cross-tenant project takeover and safeguard sensitive project data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/{id} endpoints. The GitHubTokenHTTPAuth middleware only validates that a caller presents a valid GitHub OAuth token without verifying ownership or access rights to the target project, enabling attackers with any valid GitHub token to invoke bare KV-store operations such as projects.Fetch and project.Delete against any project ID to achieve cross-tenant project takeover.