CVE-2026-13591: DeepMyst Mysti Authorization Bypass in Contact Tracking

Technical summary

The vulnerability exists in the _isTrackedConversation function within src/managers/ChannelBridge.ts. The component fails to properly validate the _channelType argument before making authorization decisions. An attacker with valid credentials can supply a malformed or unexpected channel type value, causing the authorization logic to fail and granting access to conversations that should be restricted. This is classified as improper authorization (CWE-285) combined with insufficient access control enforcement (CWE-266). The flaw allows remote exploitation but requires valid authentication and knowledge of the parameter structure.

Business impact

Depending on the deployment context, this vulnerability could allow authenticated users to access or modify conversations outside their assigned scope, potentially exposing confidential communications, customer data, or internal discussions. For organizations using Mysti for contact tracking and conversation management, an exploit could undermine audit trails, create compliance violations, and erode trust in the platform's access controls. The risk is elevated in multi-tenant environments where strict conversation segregation is required.

Affected systems

DeepMyst Mysti version 0.4.0 is confirmed affected. The vendor has not disclosed whether earlier or later versions are vulnerable; organizations should verify their version and consult the vendor advisory. The vulnerability is specific to the Contact Tracking component within the ChannelBridge module.

Exploitability

While a public exploit is available, successful exploitation requires several preconditions: the attacker must possess valid credentials, understand the channel parameter structure, and craft requests with modified _channelType values. The CVSS metric AC:H (High Attack Complexity) reflects these barriers. Real-world exploitation is realistic for insider threats or attackers who have obtained valid account credentials through other means, but opportunistic remote attacks are unlikely.

Remediation

Patch commit 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48 addresses this issue. Organizations using Mysti 0.4.0 should prioritize upgrading to the patched version. Verify the patch version through the DeepMyst security advisory or release notes before deployment.

Patch guidance

Obtain the patched version through official DeepMyst channels or your support portal. The fix targets the authorization validation logic in ChannelBridge.ts and should be tested in a non-production environment first. Since the vulnerability requires authentication, patching can be scheduled during normal maintenance windows rather than as an emergency. Confirm that the installed version includes commit 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48.

Detection guidance

Monitor for suspicious conversation access patterns, particularly across channel boundaries or by users accessing conversations outside their assigned scope. Log analysis should focus on _channelType parameter variations in API calls to the ChannelBridge component and authorization denial events that precede successful access. If available, enable enhanced logging for the Contact Tracking component and correlate user account activity with conversation access logs to identify unauthorized access.

Why prioritize this

This is a MEDIUM-severity issue affecting a core authorization function, but it is not an immediate emergency. The flaw requires authentication, making it less critical than unauthenticated vulnerabilities. However, the availability of a public exploit and the sensitivity of conversation data justify prompt attention—patch within 30 days if feasible. Organizations handling regulated customer communications should prioritize this higher.

Risk score, explained

The CVSS 3.1 score of 5.0 (MEDIUM) reflects: remote network access (AV:N), high attack complexity requiring valid credentials and parameter knowledge (AC:H), low privilege level required (PR:L), no user interaction needed (UI:N), and limited scope. The impact is partial: confidentiality and integrity can be compromised (conversations accessed or modified), but availability is unlikely to be affected. The score appropriately reflects a serious but constrained risk.

Frequently asked questions