CVE-2026-125752

Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus

Published Nov 10, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Description

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

meteroid-oss

Meteroid

unaffected

Version	Status	Constraints
`0`	affected	< 2.2.0

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.248% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/meteroid-oss/meteroid/blob/v2.1.0/modules/meteroid/crates/diesel-models/src/query/coupons.rs#L472-L486
https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2
https://github.com/meteroid-oss/meteroid/releases/tag/v2.2.0
https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor
https://www.vulncheck.com/advisories/meteroid-before-2.2.0-cross-tenant-authorization-bypass-via-updatecouponstatus

History

Nov 12, 2026 1:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 10, 2026 3:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.
Title		Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus
Weaknesses		CWE-639
References		https://github.com/meteroid-oss/meteroid/blob/v2.1.0/modules/meteroid/crates/diesel-models/src/query/coupons.rs#L472-L486 https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2 https://github.com/meteroid-oss/meteroid/releases/tag/v2.2.0 https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor https://www.vulncheck.com/advisories/meteroid-before-2.2.0-cross-tenant-authorization-bypass-via-updatecouponstatus
Metrics		cvssV3_1 `{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L'}` cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}`