Live › vulnerability › CVE-2026-119663
Tamery (formerly Conar) before 0.99.0 has a broken authorization check in its cloud sync API's connectionsResources.create handler. A logged-in user can insert attacker-named resource rows into another user's connection by sending that victim's connectionId in a batch request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Tamery users on versions 0.32.0 through before 0.99.0 who use the cloud sync API. Exposure requires an authenticated account that owns a connection, and the flaw affects the victim's listed resources rather than their data directly. Teams not running Tamery's cloud sync can skip it.
No product ranges from the sources yet.
0.99.0 or later, per the affected range in the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.
This page as .md · .json · in your agent: get_signal("CVE-2026-119663")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.