CVE-2026-81505

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.

• CWE-639

• https://github.com/frain-dev/convoy/commit/1cc67cd16fb1f8890cc83a3998d3f92dceb7fd06
• https://github.com/frain-dev/convoy/pull/2755
• https://github.com/frain-dev/convoy/releases/tag/v26.6.8
• https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4
• https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81481Dell OpenManage Server Administrator, versions prior to 11.1…7.5
• CVE-2026-81485A security vulnerability has been detected in danielpopamd l…5.3
• CVE-2026-81486A vulnerability was detected in bsmi021 mcp-file-context-ser…5.3
• CVE-2026-8149A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS b…5.1
• CVE-2026-81490A database user able to create a view in a namespace that Mo…7.7
• CVE-2026-81491A flaw has been found in boxpositron with-context-mcp up to …7.3
• CVE-2026-8151The Simple Membership MailChimp Integration WordPress plugin…5.4
• CVE-2026-81515Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-81516Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-81517An unauthenticated party able to reach the port of a MongoDB…7.5
• CVE-2026-81518When mongosqld is configured with a client certificate autho…7.5
• CVE-2026-8152Unblu Spark contains an open redirect vulnerability that can…9.3