CVE-2026-92764: OpenCVE Auth Bypass Vulnerability

CVE-2026-92764 Overview

CVE-2026-92764 is a broken access control vulnerability in OpenCVE versions before 3.1.0. The organizations API endpoint fails to scope results to the API token's organization. Instead, it returns every organization the token creator belongs to. Attackers holding an organization-scoped token can enumerate and retrieve organizations outside the intended scope. This bypasses token isolation boundaries in multi-tenant OpenCVE deployments. The flaw is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers with a low-privilege, organization-scoped API token can enumerate the full list of organizations the token creator belongs to, disclosing multi-tenant membership information beyond the token's intended boundary.

Affected Products

OpenCVE versions prior to 3.1.0
OpenCVE v2.4.0 (confirmed vulnerable code path in web/organizations/resources.py)
OpenCVE self-hosted deployments using organization-scoped API tokens

Discovery Timeline

2026-09-16 - CVE-2026-92764 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92764

Vulnerability Analysis

OpenCVE is an open-source platform for tracking Common Vulnerabilities and Exposures (CVE) feeds. It supports multi-tenant use via organizations and issues API tokens that are meant to be scoped to a single organization.

The defect resides in the organizations API resource handler at web/organizations/resources.py. When an API request presents an organization-scoped token, the handler queries organization memberships using the token creator's user identity rather than the organization associated with the token. The endpoint therefore returns every organization the creator user belongs to.

The consequence is a horizontal authorization failure. A token issued for Organization A can be used to list and read metadata for Organizations B, C, and any others the token's creator has joined. This exposes tenant membership relationships and internal organization identifiers that should be inaccessible to the token holder.

Root Cause

The root cause is missing token-scope enforcement in the organizations listing logic. The controller resolves memberships from the authenticated user object attached to the token, not from the token's declared organization scope. There is no filter clause that restricts the returned collection to the token's bound organization, which is the classic CWE-863 pattern where an authorization check exists but is applied against the wrong subject.

Attack Vector

Exploitation is remote and requires only a valid low-privileged API token. An attacker who obtains or is legitimately issued an organization-scoped token for one organization sends an authenticated HTTP GET request to the organizations API endpoint. The server returns the full set of organizations the token's creator belongs to. No user interaction, elevated privileges, or client-side conditions are required. See the VulnCheck Advisory on OpenCVE and the affected code at OpenCVE Resource Code Section for the pre-patch implementation, and the corrected logic at OpenCVE Resource Code Section v3.1.

No public proof-of-concept exploit or CISA KEV entry has been published for this issue.

Detection Methods for CVE-2026-92764

Indicators of Compromise

Successful HTTP 200 responses from the OpenCVE /api/organizations endpoint returning multiple organization objects to a token that should be scoped to a single organization.
API access logs showing a single token identifier retrieving organization records with id or name values outside its bound tenant.
Unusual enumeration patterns where one token issues repeated GET /api/organizations requests from a single source IP.

Detection Strategies

Audit OpenCVE application logs and correlate each API token identifier with the organization it was issued to; flag responses containing more than one organization for scoped tokens.
Deploy a reverse-proxy or web application firewall rule that inspects JSON responses from /api/organizations and alerts when the response array length exceeds one for token-authenticated requests.
Review OpenCVE database records for API tokens whose creators are members of multiple organizations, since these tokens are the highest-risk exposure surface for this flaw.

Monitoring Recommendations

Forward OpenCVE web-tier access logs to a centralized log platform and build an alert for anomalous access counts against the organizations endpoint per token.
Enable authenticated API request auditing and retain logs long enough to reconstruct historical token misuse after upgrade.
Monitor for creation of new API tokens by users who belong to multiple organizations and require review before issuance.

How to Mitigate CVE-2026-92764

Immediate Actions Required

Upgrade OpenCVE to version 3.1.0 or later, which corrects the token-scope check in web/organizations/resources.py. See the OpenCVE Release Version 3.1.0.
Rotate all existing organization-scoped API tokens after upgrading to invalidate any tokens that may have been used to enumerate additional organizations.
Review historical API access logs for the organizations endpoint and identify tokens that received multi-organization responses.

Patch Information

The fix is included in OpenCVE 3.1.0. The updated resource handler restricts the organizations listing to the token's bound organization instead of resolving memberships through the token creator user. Reference the upstream change at OpenCVE Resource Code Section v3.1 and the tracking discussion at OpenCVE Issue Tracker #744.

Workarounds

Restrict API token issuance to service accounts that belong to only one organization until the upgrade is applied.
Place OpenCVE behind an authenticating reverse proxy that filters /api/organizations responses to a single record per token where feasible.
Disable or revoke organization-scoped API tokens for users who belong to multiple organizations until the platform is patched.

bash

# Configuration example
# Upgrade OpenCVE to the patched release
git fetch --tags
git checkout v3.1.0
docker compose pull
docker compose up -d

# Rotate all API tokens after upgrade (run in OpenCVE shell)
# Then re-issue tokens scoped strictly to a single organization