{"id":"CVE-2026-65840","kind":"vulnerability","aliases":["CVE-2026-65840"],"related":[],"title":"Fider: email verification key from one tenant logs into another","description":"Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0.","summary":"In Fider's multi-tenant mode, a verification key issued on one tenant can be used to sign in as the same email address on a different tenant. An attacker can take over accounts across tenant boundaries.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fider","multi-tenant","other","self-hosted"],"not_affected_if":["patched-0.36.0","single-host-mode"],"how_to_check":"- Check the `HOST_MODE` environment variable; the flaw applies only when it is `multi`.\n- Check the installed Fider version; versions before `0.36.0` are affected.","fix":"- Fider: upgrade to `0.36.0` or later.","status":"open","published_at":"2026-11-11T19:17:43+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","triaged_at":"2026-11-11T19:29:41+00:00","updated_at":"2026-11-11T19:29:41+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T19:29:41Z","model":"claude-haiku-5-5","output":{"fix":"- Fider: upgrade to `0.36.0` or later.","reach":"internet","title":"Fider: email verification key from one tenant logs into another","impact":"high","summary":"In Fider's multi-tenant mode, a verification key issued on one tenant can be used to sign in as the same email address on a different tenant. An attacker can take over accounts across tenant boundaries.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fider","self-hosted","multi-tenant"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker takes over accounts on other tenants of the same instance","analyst_note":"","how_to_check":"- Check the `HOST_MODE` environment variable; the flaw applies only when it is `multi`.\n- Check the installed Fider version; versions before `0.36.0` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-host-mode","patched-0.36.0"],"who_is_affected":"Only Fider deployments running in multi-tenant mode (HOST_MODE=multi) before version 0.36.0 are exposed. Single-host deployments, the default, are not affected according to the description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000698,"input_tokens":4629,"output_tokens":471,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-65840':13A,16A '0.36.0':76C,138C 'account':59B,115C 'across':60B,117C 'address':49B,103C 'affect':130C 'allow':113C 'anoth':10A 'attack':55B,86C 'authent':98C 'b':106C 'boundari':62B 'bypass':109C 'complet':108C 'cve':11A,14A 'default':127C 'deploy':122C 'differ':52B 'email':2A,48B,90C,102C 'featur':69C 'feedback':66C 'fider':1A,17B,26B,63C 'host':24B,82C,121C,123C 'isol':111C 'issu':35B,93C,132C 'key':4A,34B,92C 'log':8A 'mode':31B,81C,83C,124C 'multi':19B,29B,79C,84C 'multi-ten':18B,28B,78C 'one':6A,37B 'patch':135C 'portal':67C 'prior':73C 'request':70C 'self':23B 'self-host':22B 'sign':43B 'singl':120C,125C 'single-host':119C 'suggest':72C 'take':57B 'takeov':116C 'tenant':7A,20B,30B,38B,53B,61B,80C,95C,105C,110C,118C 'unauthor':114C 'use':41B,88C 'verif':3A,33B,91C 'version':75C,137C","nicknames":[],"mitigations":[],"who_affected":"Only Fider deployments running in multi-tenant mode (HOST_MODE=multi) before version 0.36.0 are exposed. Single-host deployments, the default, are not affected according to the description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","fider","multitenant","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-65840':13A,16A 'anoth':10A 'cve':11A,14A 'email':2A 'fider':1A 'key':4A 'log':8A 'one':6A 'tenant':7A 'verif':3A","search_b":"'account':59B 'across':60B 'address':49B 'attack':55B 'boundari':62B 'differ':52B 'email':48B 'fider':17B,26B 'host':24B 'issu':35B 'key':34B 'mode':31B 'multi':19B,29B 'multi-ten':18B,28B 'one':37B 'self':23B 'self-host':22B 'sign':43B 'take':57B 'tenant':20B,30B,38B,53B,61B 'use':41B 'verif':33B","search_c":"'0.36.0':76C,138C 'account':115C 'across':117C 'address':103C 'affect':130C 'allow':113C 'attack':86C 'authent':98C 'b':106C 'bypass':109C 'complet':108C 'default':127C 'deploy':122C 'email':90C,102C 'featur':69C 'feedback':66C 'fider':63C 'host':82C,121C,123C 'isol':111C 'issu':93C,132C 'key':92C 'mode':81C,83C,124C 'multi':79C,84C 'multi-ten':78C 'patch':135C 'portal':67C 'prior':73C 'request':70C 'singl':120C,125C 'single-host':119C 'suggest':72C 'takeov':116C 'tenant':80C,95C,105C,110C,118C 'unauthor':114C 'use':88C 'verif':91C 'version':75C,137C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T15:09:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65840","severity":null,"published_at":"2026-11-11T19:17:43+00:00","modified_at":"2026-11-11T19:17:43+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","fetched_at":"2026-11-11T19:28:48+00:00","note":null}],"documents":[{"id":128146,"url":"https://github.com/getfider/fider/releases/tag/v0.36.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128147,"url":"https://github.com/getfider/fider/security/advisories/GHSA-vxjw-gv4f-vq58","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T15:09:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}