CVE-2026-44678

Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID without verifying that the preview belongs to the project resolved from the URL path. The route's project-level authorization plug (AuthorizationPlug, :preview) authorizes the caller against the project encoded in account_handle/project_handle — which the attacker controls — and then the action deletes whichever preview's UUID is supplied. The check therefore guards the wrong project.

• CWE-639

• https://github.com/tuist/tuist/security/advisories/GHSA-fqp5-hg46-cp2x

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44669FACTION is a PenTesting Report Generation and Collaboration …8.7
• CVE-2026-4467A vulnerability was found in Comfast CF-AC100 2.6.0.8. This …4.7
• CVE-2026-44670SiYuan is an open-source personal knowledge management syste…9.4
• CVE-2026-44671ZITADEL is an open source identity management platform. From…7.5
• CVE-2026-44672mapfish-print is a component of MapFish for printing templat…9.3
• CVE-2026-44673libyang is a YANG data modeling language library. Prior to S…7.5
• CVE-2026-44679Tuist is a virtual platform team for Swift app devs. Prior t…6.9
• CVE-2026-4468A vulnerability was determined in Comfast CF-AC100 2.6.0.8. …4.7
• CVE-2026-44680MikroORM is a TypeScript ORM for Node.js based on Data Mappe…7.6
• CVE-2026-44681Authlib is a Python library which builds OAuth and OpenID Co…6.1
• CVE-2026-44682Local privilege escalation due to DLL hijacking vulnerabilit…7.3
• CVE-2026-44687In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stu…3.7