CVE-2026-65965 · Other
NO FIX YET · SEE WHAT TO DO
ideon is a self-hosted visual workspace. Users granted only the read-only viewer role on a project can call project write endpoints, including one that deletes all blocks and links and inserts attacker-supplied ones.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only self-hosted ideon instances before 0.9.4 where users with the viewer role on a project can reach the project mutation endpoints under /api/projects/[id]/*. The collaborators, automation and realtime sync paths already enforce viewer read-only status, so the flaw is confined to the affected HTTP handlers. Teams not running ideon, or running a patched version, can skip it.
Not affected if patched-0.9.4-or-later
Who cares ideon, self-hosted
0.9.4.0.9.4 or later.ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. The most severe is POST /api/projects/[id]/graph, which deletes every block and link in the project and re-inserts client-supplied ones. A viewer can silently rewrite or wipe the entire canvas of a project they were invited to read. The application clearly intends viewer to be read-only: the collaborators endpoint, the automation endpoints, and the realtime Yjs sync path all reject write attempts from viewers. These specific HTTP handlers simply omit the guard their siblings enforce. This issue has been patched in version 0.9.4.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.