CVE-2026-50875 Overview
CVE-2026-50875 is a broken access control vulnerability in Deck9 Input v2.0.1. The flaw resides in the /{form}/webhooks/{webhook} endpoint, which fails to enforce tenant isolation. Authenticated attackers can send crafted requests to modify or delete webhooks belonging to other tenants. The issue is tracked under CWE-284: Improper Access Control and affects the integrity and availability of webhook configurations across the multi-tenant deployment.
Critical Impact
Authenticated attackers can tamper with or delete webhooks owned by other tenants, disrupting downstream integrations and exposing tenants to data loss or workflow corruption.
Affected Products
- Deck9 Input v2.0.1
- Multi-tenant deployments exposing the /{form}/webhooks/{webhook} endpoint
- Downstream services consuming webhooks managed by affected installations
Discovery Timeline
- 2026-06-15 - CVE-2026-50875 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-50875
Vulnerability Analysis
The vulnerability stems from missing authorization checks on the /{form}/webhooks/{webhook} route in Deck9 Input v2.0.1. The endpoint accepts the webhook identifier directly from the URL path and operates on the referenced object without confirming it belongs to the requesting tenant. Any authenticated user with a valid session can therefore reference webhook identifiers owned by another tenant.
Webhooks are typically used to relay form submissions to external systems. Tampering with webhook records can redirect, suppress, or destroy these notifications. The flaw qualifies as an Insecure Direct Object Reference combined with Broken Access Control.
Root Cause
The root cause is the absence of an ownership check between the authenticated principal's tenant context and the tenant that owns the referenced webhook. The handler trusts the path parameter as a sufficient locator and does not constrain queries by tenant_id. Authorization is reduced to authentication, which is insufficient in a multi-tenant model.
Attack Vector
Exploitation requires only valid credentials on the platform. An attacker enumerates or guesses another tenant's webhook identifier and issues an HTTP PUT, PATCH, or DELETE request to /{form}/webhooks/{webhook}. The server processes the request as if the attacker owned the resource. User interaction is not required, and the request can be issued from any network-reachable client.
A proof-of-concept demonstrating the request flow is referenced in the GitHub Gist PoC Code.
Detection Methods for CVE-2026-50875
Indicators of Compromise
- Unexpected PUT, PATCH, or DELETE requests to /{form}/webhooks/{webhook} originating from accounts that do not own the referenced webhook
- Webhook configuration changes or deletions not correlated with legitimate tenant administrator activity
- Spikes in failed deliveries or silent loss of webhook events for a specific tenant
Detection Strategies
- Correlate application audit logs of webhook mutations with the authenticated user's tenant identifier to flag cross-tenant references
- Alert on sequential access to webhook identifiers that span multiple tenant scopes within a single session
- Inspect web server access logs for non-administrative principals issuing destructive HTTP verbs against the /{form}/webhooks/ path
Monitoring Recommendations
- Enable verbose application logging for all webhook CRUD operations, including requesting user, tenant ID, and target webhook ID
- Forward authentication and API logs to a centralized analytics platform for cross-tenant anomaly detection
- Establish a baseline of normal webhook modification volume per tenant and alert on deviations
How to Mitigate CVE-2026-50875
Immediate Actions Required
- Inventory all Deck9 Input v2.0.1 instances and restrict the /{form}/webhooks/{webhook} endpoint at the reverse proxy until patched
- Audit recent webhook modifications and deletions to identify unauthorized changes
- Rotate webhook secrets and validate webhook destinations with each tenant
Patch Information
No vendor advisory or patched version is listed in the NVD record at the time of publication. Operators should monitor Deck9 communications for an updated release of Input that supersedes v2.0.1 and apply it once available.
Workarounds
- Place the application behind an API gateway that enforces tenant-aware authorization on the /{form}/webhooks/ path
- Implement a server-side middleware check that validates tenant_id ownership for every webhook reference before the handler executes
- Reduce the blast radius by limiting which roles can issue write or delete operations on webhooks
- Temporarily disable the webhook management endpoint if it is not in active use
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
