---
id: "CVE-2026-125752"
page: "https://infrastack.ai/live/CVE-2026-125752"
kind: "vulnerability"
aliases: ["CVE-2026-125752"]
title: "Meteroid: tenant users can change other tenants' coupons via gRPC"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["grpc", "meteroid", "other", "self-hosted"]
not_affected_if: ["no-untrusted-authenticated-users", "version-2.2.0-or-later"]
published_at: "2026-11-10T16:17:21+00:00"
first_seen_at: "2026-11-10T16:22:34+00:00"
updated_at: "2026-11-10T16:23:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125752", "first_seen_at": "2026-11-10T16:22:34+00:00"}]
exploit_sources: []
---

# Meteroid: tenant users can change other tenants' coupons via gRPC

Link for people: https://infrastack.ai/live/CVE-2026-125752 (this .md is for agents)

Meteroid before 2.2.0 has a flaw in its CouponsService UpdateCouponStatus gRPC handler, where the update matches only on coupon ID and ignores the tenant. An authenticated user can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and read its details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Meteroid version in use; affected versions are those before `2.2.0`.
- Review which accounts hold `catalog:manage` or tenant-scoped API keys, since these are the required privileges.

## Fix

- Move to Meteroid `2.2.0` or later.

## Timeline

- 2026-11-10T16:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125752

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/meteroid-before-2.2.0-cross-tenant-authorization-bypass-via-updatecouponstatus
- [fix] Patch: github.com https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2
- [fix] Release notes: github.com https://github.com/meteroid-oss/meteroid/releases/tag/v2.2.0

## From the sources

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_