HIGH 8.5 GitHub
CVE-2026-59185
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
## Summary
identrail's GitHub App connection-completion endpoint binds a fully client-supplied `installation_id` to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation access token for the supplied `installation_id` using the app's own JWT, so an authenticated tenant can link any other identrail customer's GitHub App installation into their own workspace and
Affected Products
- go/github.com/identrail/identrail < 1.0.2
References
- https://github.com/advisories/GHSA-cp3j-m783-3ph5
- https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5
- https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7
- https://github.com/identrail/identrail/releases/tag/v1.0.2
This high severity vulnerability with a CVSS score of 8.5 was published on 2026-09-09 via GitHub. Affected: go/github.com/identrail/identrail < 1.0.2.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.