Skip to content
Heist/ feed
Back to feed
Medium

Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure

Type: advisorySources: OSV

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-89112
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 03:31 UTC · Revision 1

Source evidence

Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure

core-osv · Original source

Published 13 Oct 2026, 00:26 UTC

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.

osv:CVE-2026-89112
Complete source record
{
  "id": "c8366f3ca02d11b7cd3bae76b108c96965e1521fa477d4edc409c94ab5bfbea3",
  "url": "https://osv.dev/vulnerability/CVE-2026-89112",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure",
    "summary": "The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.",
    "evidence": "osv:CVE-2026-89112",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-89112",
      "aliases": [
        "CVE-2026-89112",
        "GHSA-8rcv-xqgf-8743"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/cla-assistant/cla-assistant",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "bca7573c14ba50a1073a684f3c5f4b28733a3c60"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "v2.13.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.13.1",
            "v2.13.0",
            "v2.12.0",
            "v2.11.0",
            "v2.10.0",
            "v2.9.3",
            "v2.9.2",
            "v2.9.1",
            "v2.9.0",
            "v2.8.6",
            "v2.8.5",
            "v2.8.4",
            "v2.8.3",
            "v2.8.2",
            "v2.8.1",
            "v2.8.0",
            "v2.7.0",
            "v2.6.2",
            "v2.6.1",
            "v2.6.0",
            "v2.5.2",
            "v2.5.1",
            "v2.5.0",
            "v2.4.6",
            "v2.4.5",
            "v2.4.4",
            "v2.4.3",
            "v2.4.2",
            "v1.10.0",
            "v2.4.1",
            "v2.4.0",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.1",
            "v2.2.0",
            "v2.1.1",
            "v2.1.0",
            "v2.0.3",
            "v2.0.2",
            "v2",
            "v2.0.1",
            "v2.0.0",
            "v1.10.1",
            "v1.9.2",
            "v1.9.1",
            "v1.9.0",
            "v1.8.4",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.1",
            "v1.7.0",
            "v1.6.0",
            "v1.5.0",
            "v1.4.1",
            "v1.4.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89112.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.221777955Z",
      "provider": "osv",
      "references": [
        "https://url.sap/sapsecuritypatchday",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89112.json",
        "https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-8rcv-xqgf-8743",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-89112"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "cna_assigner": "sap",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89112.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-89112",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 522230,
  "published_at": "2026-10-13T00:26:06.824+00:00"
}