CVE-2026-59151

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59151", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-02T16:50:27.886Z", "datePublished": "2026-07-10T17:50:07.303Z", "dateUpdated": "2026-07-13T18:03:20.394Z"}, "containers": {"cna": {"title": "Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp"}, {"name": "https://github.com/prowler-cloud/prowler/pull/11650", "tags": ["x_refsource_MISC"], "url": "https://github.com/prowler-cloud/prowler/pull/11650"}, {"name": "https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e", "tags": ["x_refsource_MISC"], "url": "https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e"}, {"name": "https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7", "tags": ["x_refsource_MISC"], "url": "https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7"}, {"name": "https://github.com/prowler-cloud/prowler/releases/tag/5.30.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/prowler-cloud/prowler/releases/tag/5.30.3"}], "affected": [{"vendor": "prowler-cloud", "product": "prowler", "versions": [{"version": "< 5.30.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T17:50:07.303Z"}, "descriptions": [{"lang": "en", "value": "Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3."}], "source": {"advisory": "GHSA-h8m9-jgf8-vwvp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:02:53.136588Z", "id": "CVE-2026-59151", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:03:20.394Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59151", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:02:53.136588Z"}}}], "references": [{"url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:02:36.827Z"}}], "cna": {"title": "Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover", "source": {"advisory": "GHSA-h8m9-jgf8-vwvp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "prowler-cloud", "product": "prowler", "versions": [{"status": "affected", "version": "< 5.30.3"}]}], "references": [{"url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp", "name": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/prowler-cloud/prowler/pull/11650", "name": "https://github.com/prowler-cloud/prowler/pull/11650", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e", "name": "https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7", "name": "https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/prowler-cloud/prowler/releases/tag/5.30.3", "name": "https://github.com/prowler-cloud/prowler/releases/tag/5.30.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T17:50:07.303Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59151", "state": "PUBLISHED", "dateUpdated": "2026-07-13T18:03:20.394Z", "dateReserved": "2026-07-02T16:50:27.886Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T17:50:07.303Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "prowler", "vendor": "prowler-cloud", "versions": [{"status": "affected", "version": "< 5.30.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:prowler:prowler:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDDA7D72-36D3-4733-BBF2-7522179611EF", "versionEndExcluding": "5.30.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3."}, {"lang": "es", "value": "Prowler es una plataforma de seguridad en la nube. Antes de la versi\u00f3n 5.30.3, el flujo de autenticaci\u00f3n SAML de Prowler confiaba en el dominio de correo electr\u00f3nico afirmado en una SAMLResponse al decidir qu\u00e9 inquilino deber\u00eda recibir el token final, y la l\u00f3gica de finalizaci\u00f3n de ACS en api/src/backend/api/v1/views.py recalculaba el inquilino a partir de user.email en lugar de vincular la emisi\u00f3n del token a la configuraci\u00f3n SAML validada. Un atacante autenticado con un IdP SAML controlado podr\u00eda completar un flujo SAML v\u00e1lido para un dominio controlado por el atacante mientras afirmaba una direcci\u00f3n de correo electr\u00f3nico de otro dominio configurado, lo que provocar\u00eda que se emitiera un SAMLToken y un JWT con alcance de inquilino para el inquilino incorrecto y permitir\u00eda la toma de control de cuentas entre inquilinos. Este problema est\u00e1 solucionado en la versi\u00f3n 5.30.3."}], "id": "CVE-2026-59151", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59151", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-13T18:02:53.136588Z", "version": "2.0.3"}}]}, "published": "2026-07-10T19:17:26.780", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/prowler-cloud/prowler/pull/11650"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/prowler-cloud/prowler/releases/tag/5.30.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.30.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "prowler", "source": "cna", "vendor": "prowler-cloud"}, "product": "prowler", "vendor": "prowler-cloud"}], "created": "2026-07-11T10:45:04.545144+00:00", "updated": "2026-08-01T12:30:04.126097+00:00", "vendors": ["prowler-cloud", "prowler-cloud$PRODUCT$prowler"]}