{"id":"CVE-2026-125752","kind":"vulnerability","aliases":["CVE-2026-125752"],"related":[],"title":"Meteroid: tenant users can change other tenants' coupons via gRPC","description":"Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.","summary":"Meteroid before 2.2.0 has a flaw in its CouponsService UpdateCouponStatus gRPC handler, where the update matches only on coupon ID and ignores the tenant. An authenticated user can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and read its details.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grpc","meteroid","other","self-hosted"],"not_affected_if":["no-untrusted-authenticated-users","version-2.2.0-or-later"],"how_to_check":"- Check the Meteroid version in use; affected versions are those before `2.2.0`.\n- Review which accounts hold `catalog:manage` or tenant-scoped API keys, since these are the required privileges.","fix":"- Move to Meteroid `2.2.0` or later.","status":"open","published_at":"2026-11-10T16:17:21+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:40+00:00","updated_at":"2026-11-10T16:23:40+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T16:23:40Z","model":"claude-haiku-5-5","output":{"fix":"- Move to Meteroid `2.2.0` or later.","reach":"network","title":"Meteroid: tenant users can change other tenants' coupons via gRPC","impact":"medium","summary":"Meteroid before 2.2.0 has a flaw in its CouponsService UpdateCouponStatus gRPC handler, where the update matches only on coupon ID and ignores the tenant. An authenticated user can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and read its details.","audience":"businesses","category":"other","nicknames":[],"who_cares":["meteroid","self-hosted","grpc"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Another tenant's coupons get disabled, archived, or their details read","analyst_note":"Sources do not say whether the coupon details exposed include sensitive data beyond coupon fields.","how_to_check":"- Check the Meteroid version in use; affected versions are those before `2.2.0`.\n- Review which accounts hold `catalog:manage` or tenant-scoped API keys, since these are the required privileges.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2.2.0-or-later","no-untrusted-authenticated-users"],"who_is_affected":"Teams that self-host or run Meteroid before version 2.2.0 and have multiple tenants or users with catalog:manage or tenant-scoped API keys. The flaw needs an authenticated account, so deployments where only trusted single-tenant users have access carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4647,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125752':13A,16A '-2026':12A,15A '2.2.0':25B,72C 'anoth':52B,113C 'api':109C 'archiv':59B,120C 'authent':48B,99C 'author':78C 'bypass':79C 'catalog':102C 'chang':5A 'contain':73C 'coupon':8A,41B,55B,65B,93C,116C,126C 'couponsservic':31B,83C 'cross':76C 'cross-ten':75C 'cve':11A,14A 'detail':69B,130C 'disabl':58B,119C 'enabl':63B,124C 'filter':90C 'flaw':28B 'grpc':10A,17B,33B,85C 'handler':34B,86C 'host':22B 'id':42B,56B,94C,98C,117C 'ignor':44B,96C 'key':110C 'manag':103C 'match':38B 'meteroid':1A,18B,23B,70C 'queri':89C 're':62B,123C 're-en':61B,122C 'read':67B 'receiv':128C 'scope':108C 'self':21B 'self-host':20B 'suppli':51B,112C 'tenant':2A,7A,46B,53B,77C,97C,107C,114C 'tenant-scop':106C 'updat':37B,88C 'updatecouponstatus':32B,84C 'user':3A,49B,100C 'via':9A 'vulner':80C 'whose':87C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host or run Meteroid before version 2.2.0 and have multiple tenants or users with catalog:manage or tenant-scoped API keys. The flaw needs an authenticated account, so deployments where only trusted single-tenant users have access carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["grpc","medium","meteroid","other","selfhosted"],"campaign_type":null,"search_a":"'-125752':13A,16A '-2026':12A,15A 'chang':5A 'coupon':8A 'cve':11A,14A 'grpc':10A 'meteroid':1A 'tenant':2A,7A 'user':3A 'via':9A","search_b":"'2.2.0':25B 'anoth':52B 'archiv':59B 'authent':48B 'coupon':41B,55B,65B 'couponsservic':31B 'detail':69B 'disabl':58B 'enabl':63B 'flaw':28B 'grpc':17B,33B 'handler':34B 'host':22B 'id':42B,56B 'ignor':44B 'match':38B 'meteroid':18B,23B 're':62B 're-en':61B 'read':67B 'self':21B 'self-host':20B 'suppli':51B 'tenant':46B,53B 'updat':37B 'updatecouponstatus':32B 'user':49B","search_c":"'2.2.0':72C 'anoth':113C 'api':109C 'archiv':120C 'authent':99C 'author':78C 'bypass':79C 'catalog':102C 'contain':73C 'coupon':93C,116C,126C 'couponsservic':83C 'cross':76C 'cross-ten':75C 'detail':130C 'disabl':119C 'enabl':124C 'filter':90C 'grpc':85C 'handler':86C 'id':94C,98C,117C 'ignor':96C 'key':110C 'manag':103C 'meteroid':70C 'queri':89C 're':123C 're-en':122C 'receiv':128C 'scope':108C 'suppli':112C 'tenant':77C,97C,107C,114C 'tenant-scop':106C 'updat':88C 'updatecouponstatus':84C 'user':100C 'vulner':80C 'whose':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125752","severity":null,"published_at":"2026-11-10T16:17:21+00:00","modified_at":"2026-11-10T16:17:21+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[{"id":116115,"url":"https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116116,"url":"https://github.com/meteroid-oss/meteroid/releases/tag/v2.2.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116120,"url":"https://www.vulncheck.com/advisories/meteroid-before-2.2.0-cross-tenant-authorization-bypass-via-updatecouponstatus","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}