CVE-2026-13591 Overview
CVE-2026-13591 identifies an improper authorization weakness in DeepMyst Mysti version 0.4.0. The flaw resides in the _isTrackedConversation function of src/managers/ChannelBridge.ts, part of the Contact Tracking component. An attacker can manipulate the _channelType argument to bypass authorization checks. The issue is classified under CWE-266: Incorrect Privilege Assignment. Exploitation is possible over the network but requires high attack complexity and low-privilege access. A public exploit exists, and the vendor has published patch commit 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48.
Critical Impact
A remote attacker with low privileges can manipulate the _channelType argument passed to _isTrackedConversation to bypass conversation tracking authorization in DeepMyst Mysti 0.4.0.
Affected Products
- DeepMyst Mysti 0.4.0
- Component: src/managers/ChannelBridge.ts (Contact Tracking)
- Function: _isTrackedConversation
Discovery Timeline
- 2026-06-29 - CVE-2026-13591 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-13591
Vulnerability Analysis
The vulnerability originates in the _isTrackedConversation function within src/managers/ChannelBridge.ts. This function is responsible for determining whether a given conversation should be tracked by the Contact Tracking component. The function relies on the caller-supplied _channelType argument to make an authorization decision. Because the code does not sufficiently validate or normalize _channelType, an attacker can supply crafted values that cause the check to return an unintended result. This behavior maps to CWE-266, where privilege assignment is incorrect relative to the actor's real context.
Root Cause
The root cause is trust placed in a caller-controlled input during an authorization decision. _isTrackedConversation uses _channelType as a discriminator without enforcing that the value corresponds to a channel the requester is actually authorized to interact with. See the GitHub commit 9b4aff0f for the corrective change.
Attack Vector
Exploitation occurs remotely over the network. The attacker must already hold low-privilege access to the Mysti instance and must craft input carefully, which raises attack complexity. Impact on confidentiality, integrity, and availability is limited in scope. Technical detail on the vulnerable path is available in the VulDB entry and the associated pull request.
No verified proof-of-concept code is reproduced here. Refer to the GitHub issue #42 for reported behavior and the patch commit for the authoritative diff.
Detection Methods for CVE-2026-13591
Indicators of Compromise
- Unexpected invocations of _isTrackedConversation with _channelType values that do not match the requester's authorized channels.
- Contact Tracking log entries showing conversations flagged as tracked or untracked in a pattern inconsistent with normal user activity.
- Authenticated low-privilege sessions issuing repeated requests that toggle or probe _channelType values.
Detection Strategies
- Instrument ChannelBridge.ts to log the resolved _channelType, the caller identity, and the authorization outcome for later correlation.
- Compare pre- and post-patch behavior in staging to build a baseline of legitimate _channelType values.
- Alert on authorization decisions where _channelType falls outside the enumerated set expected for a given user role.
Monitoring Recommendations
- Forward Mysti application logs into a centralized analytics pipeline and retain them long enough to investigate low-and-slow probing.
- Track error rates and 4xx responses tied to Contact Tracking endpoints as a proxy for exploitation attempts.
- Review authenticated session activity for accounts exhibiting anomalous channel enumeration patterns.
How to Mitigate CVE-2026-13591
Immediate Actions Required
- Upgrade DeepMyst Mysti to a build that includes patch commit 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48.
- Audit existing sessions and API tokens for low-privilege accounts that could reach the Contact Tracking component.
- Review Contact Tracking data for entries that may have been created or suppressed via manipulated _channelType values.
Patch Information
The vendor has published a fix in commit 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48 via pull request #43. Consult the DeepMyst Mysti repository for release artifacts that include the fix.
Workarounds
- Restrict network reachability of the Mysti application so only trusted authenticated users can invoke Contact Tracking functionality.
- Enforce least privilege on Mysti accounts to reduce the population of users who satisfy the low-privilege precondition.
- Add an application-layer allowlist that rejects unexpected _channelType values before they reach _isTrackedConversation.
# Configuration example: apply the upstream patch and rebuild
git fetch origin
git checkout 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48 -- src/managers/ChannelBridge.ts
npm install
npm run build
npm test
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
