CVE-2026-125751 · Other
NO FIX YET · SEE WHAT TO DO
Meteroid before 2.2.0 has a gRPC handler, GetApiTokenById, that does not check the caller's tenant. A signed-in user with settings:read permission can request another tenant's API token ID and receive that token's Argon2 secret hash and owning tenant ID.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host Meteroid or run it for multiple tenants, where users with settings:read permission share the instance. The flaw needs an authenticated account, so single-tenant deployments with only trusted users are lower risk. unknown whether the sources list other conditions.
Not affected if single-tenant-trusted-users, version-2.2.0-or-later
Who cares grpc, meteroid, multi-tenant, self-hosted
2.2.0 are affected.2.2.0 or later.Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash and owning tenant ID.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.