CVE-2026-65840 · Other
NO FIX YET · SEE WHAT TO DO
In Fider's multi-tenant mode, a verification key issued on one tenant can be used to sign in as the same email address on a different tenant. An attacker can take over accounts across tenant boundaries.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Fider deployments running in multi-tenant mode (HOST_MODE=multi) before version 0.36.0 are exposed. Single-host deployments, the default, are not affected according to the description.
Not affected if patched-0.36.0, single-host-mode
Who cares fider, multi-tenant, self-hosted
HOST_MODE environment variable; the flaw applies only when it is multi.0.36.0 are affected.0.36.0 or later.Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.