← All CVEs
CVE-2026-57510
High · CVSS 8.7Published 2026-07-28
CVSS
8.7
EPSS
—
Exploited
No
Summary
SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.
References
- https://github.com/superplanehq/superplane/commit/3e45cf4f1b5f1be9fbbfd90c97960a73f00f897b
- https://github.com/superplanehq/superplane/pull/5635
- https://github.com/superplanehq/superplane/releases/tag/v0.27.0
- https://www.vulncheck.com/advisories/superplane-broken-object-level-authorization-via-canvasservice-grpc
Is your stack affected?
Pentevo's AI pentest continuously checks your systems against known vulnerabilities like this one.
Recent CVEs
- CVE-2026-65441Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.7.1
- CVE-2026-65442Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.7.2
- CVE-2026-65443Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.7.1
- CVE-2026-65445Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.6.5
- CVE-2026-65446Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.7.1
- CVE-2026-65447Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.7.1