---
id: "CVE-2026-123797"
page: "https://infrastack.ai/live/CVE-2026-123797"
kind: "vulnerability"
aliases: ["CVE-2026-123797"]
title: "SuperTokens Core: unauthenticated callers can create and list app roles"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["authentication", "package", "self-hosted", "supertokens"]
not_affected_if: ["core-not-exposed", "managed-hosting"]
published_at: "2026-11-09T18:17:26+00:00"
first_seen_at: "2026-11-09T18:27:56+00:00"
updated_at: "2026-11-09T18:29:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123797", "first_seen_at": "2026-11-09T18:27:56+00:00"}]
exploit_sources: []
---

# SuperTokens Core: unauthenticated callers can create and list app roles

Link for people: https://infrastack.ai/live/CVE-2026-123797 (this .md is for agents)

SuperTokens Core is an open source authentication server. Requests using an unknown tenant path and an older cdi-version skip the API-key and public-tenant checks, letting an unauthenticated caller create and enumerate application roles.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SuperTokens Core version against the fixed versions listed below.
- Look for the Core endpoints `PUT /ghosttenant/recipe/role` and `GET /ghosttenant/recipe/roles` reachable from outside your network.

## Fix

- Upgrade to `11.3.6`, `11.4.6`, or `12.0.8`, matching your release line.

## Timeline

- 2026-11-09T18:27:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123797

## Documents

- [advisory] Vendor advisory: github.com https://github.com/supertokens/supertokens-core/security/advisories/GHSA-q7mc-f2jm-r4gr
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/5811a10190b1d4d8d7a9fe2e17cb49437e6ffa49
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/7ce22db2b6ba95d7666adc51bb9ee60ac7d3d198
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/1bad648d7b77aca058cb6bf75373455bacc4e537
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.4.6
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v12.0.8
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.3.6

## From the sources

SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_