CVE-2026-77169: Team Folders App Auth Bypass Vulnerability

CVE-2026-77169 Overview

CVE-2026-77169 is a broken access control vulnerability [CWE-284] affecting the team folders app (formerly group folders) when used alongside the workspace app. The workspace app allows organizations to delegate limited administrative privileges for team folder management through API/REST endpoints only. Delegated administrators are expected to operate only on folders where they hold advanced permissions. The flaw allows these API/REST-only delegated administrators to bypass folder-level authorization checks and access or modify team folders outside their assigned scope.

Critical Impact

Delegated administrators with restricted API-only privileges can bypass folder-level authorization and gain unauthorized access to team folder contents and configurations.

Affected Products

• Team folders app (formerly group folders app)
• Workspace app (when combined with team folders)
• Deployments using API/REST delegated administration for team folders

Discovery Timeline

• 2026-09-18 - CVE-2026-77169 published to the National Vulnerability Database (NVD)
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-77169

Vulnerability Analysis

The vulnerability resides in the authorization logic that governs delegated administration of team folders. The workspace app introduces a delegation model where an administrator receives advanced permissions on a defined subset of folders and is expected to manage only those folders through API/REST endpoints. The team folders app fails to consistently enforce folder-level scope checks when this delegated identity invokes management APIs. As a result, actions authorized on one folder are effectively usable against folders the administrator does not own.

Exploitation requires the attacker to already hold a delegated administrator role, so the abuse path is limited to insiders or accounts compromised through other means. Once invoked, however, the bypass yields high impact on confidentiality and integrity of team folder data across the tenant.

Root Cause

The root cause is improper access control [CWE-284]. The API layer validates that the caller holds the delegated administrator role but does not validate that the target folder is within the caller's assigned advanced-permission scope. This missing scope check collapses per-folder authorization into a role-level check.

Attack Vector

The attack vector is network-based and requires authenticated, high-privilege access. An API/REST-only delegated administrator issues management requests referencing folder identifiers outside their assigned scope. The server processes the requests without rejecting them, permitting read or modification operations. User interaction is not required. See the HackerOne Report #3674940 for technical details.

Detection Methods for CVE-2026-77169

Indicators of Compromise

• API/REST calls from delegated administrator accounts targeting folder identifiers outside their known assignment scope.
• Unexpected modifications to team folder permissions, quotas, or membership performed by accounts without an interactive session.
• Bursts of enumeration requests against team folder management endpoints from a single delegated account.

Detection Strategies

• Correlate delegated administrator identities with their assigned folder scope, then flag any API call referencing a folder outside that mapping.
• Baseline normal management API usage per delegated administrator and alert on deviations in folder targets or request volume.
• Review audit logs for permission or configuration changes issued through REST endpoints without a corresponding UI session.

Monitoring Recommendations

• Enable verbose audit logging on team folders management endpoints and forward logs to a central analytics platform.
• Monitor authentication and authorization events tied to service accounts and API tokens used for workspace delegation.
• Alert on privilege-sensitive operations such as folder creation, deletion, ACL changes, and membership updates initiated by delegated roles.

How to Mitigate CVE-2026-77169

Immediate Actions Required

• Inventory all accounts granted delegated administrator privileges through the workspace app and validate that each still requires access.
• Rotate API tokens and credentials assigned to workspace-delegated administrators to invalidate any that may have been misused.
• Review recent audit logs for team folder operations performed outside expected administrative scope.

Patch Information

Apply the vendor patches for the team folders and workspace apps as soon as they are available. Consult the HackerOne Report #3674940 and upstream vendor advisories for fixed version details. Until patches are applied, treat any delegated administrator as effectively holding tenant-wide team folder access.

Workarounds

• Temporarily revoke the workspace app's delegated administrator role or disable the workspace app until patched builds are deployed.
• Restrict team folder management to full administrators and disable the API/REST delegation path for non-privileged accounts.
• Enforce network-level access controls on team folder management endpoints so only trusted management hosts can reach them.

# Configuration example: audit and revoke delegated workspace admins
# 1. List accounts with workspace delegated admin privileges
#    (consult vendor CLI/API documentation for exact commands)
# 2. Revoke the delegated role until patches are applied
# 3. Rotate any API tokens bound to those accounts