CVE-2026-50875: Cross-Tenant Webhook Access Control Flaw in Deck9 Input v2.0.1

Technical summary

CVE-2026-50875 is an incorrect access control vulnerability (CWE-284) in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1. The endpoint fails to properly validate that the authenticated user belongs to the same tenant as the webhook resource being modified or deleted. An authenticated attacker can supply another tenant's webhook identifier in a crafted HTTP request and successfully perform DELETE or PUT operations, achieving cross-tenant data manipulation. The CVSS 3.1 score of 8.1 (HIGH) reflects the requirement for valid authentication (PR:L), network accessibility (AV:N), and the high impact on integrity and availability (I:H, A:H).

Business impact

Compromised webhook integrity can disrupt critical data pipelines and integrations. An attacker could redirect form submissions to attacker-controlled servers, delete webhooks to halt automated workflows, or modify webhook URLs to intercept sensitive customer data. For SaaS deployments serving multiple tenants, this represents a severe isolation failure. Affected organizations may face data loss, service unavailability, customer notification obligations, and reputational harm. The blast radius depends on webhook usage patterns; heavy reliance on webhooks for payment processing or compliance notifications amplifies risk.

Affected systems

Deck9 Input version 2.0.1 is confirmed affected. Organizations running this version in production environments with multi-tenant deployments or shared hosting scenarios face direct risk. Versions prior to and after 2.0.1 should be verified against the vendor's official advisory to determine the scope of vulnerable releases. Deployments using webhook integrations for critical workflows face the highest exposure.

Exploitability

Exploitability is moderate to high. The attack requires valid authentication credentials (ruling out unauthenticated exploitation) and knowledge of another tenant's webhook identifiers, but no complex technical steps, race conditions, or user interaction are needed. Webhook IDs may be discoverable through information disclosure, API enumeration, or common naming patterns. The simplicity of the request crafting and lack of additional mitigations make this practical to exploit once an attacker gains initial account access or credentials through phishing or credential compromise.

Remediation

Apply the security patch released by Deck9 for this vulnerability. The patch should implement proper tenant isolation checks before allowing webhook modification or deletion—validating that the authenticated user's tenant owns the target webhook. Until patching is possible, implement network-level access controls restricting webhook endpoint access, disable webhook functionality if not actively used, and audit webhook configurations regularly for unauthorized modifications. Rotate webhook URLs and monitor webhook invocation logs for suspicious activity.

Patch guidance

Consult Deck9's official security advisory for the patched version number and deployment instructions. Typically, apply the patch in a staging environment first, verify webhook functionality across your tenant's forms, and roll out to production during a maintenance window. If automatic updates are available through your deployment method (cloud, on-premise), prioritize enabling them. Test that webhook delivery and modification workflows function correctly post-patch.

Detection guidance

Monitor HTTP logs and API audit trails for unusual DELETE or PUT requests to /{form}/webhooks/{webhook} endpoints, especially those with webhook IDs not belonging to the requesting user's tenant. Look for rapid sequences of webhook modification attempts or deletions, which may indicate automated exploitation. Enable API rate limiting on webhook management endpoints. Implement alerts for cross-tenant requests or permission violations. Review webhook configuration change logs regularly and correlate with authentication timestamps to identify suspicious modifications.

Why prioritize this

This vulnerability merits urgent patching due to its HIGH CVSS score (8.1), multi-tenant impact, and ease of exploitation once credentials are obtained. The integrity and availability impact (I:H, A:H) means an attacker can cause tangible, immediate harm to customer data and service continuity. While the attack requires authentication, the low technical barrier and potential for mass exploitation across tenants make this a top remediation priority.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (1) network-accessible endpoint requiring no special network configuration (AV:N); (2) low attack complexity—standard HTTP requests suffice (AC:L); (3) low privilege requirement—any authenticated user qualifies (PR:L); (4) no user interaction needed (UI:N); (5) unchanged scope (S:U); (6) no confidentiality impact (C:N); (7) high integrity impact from unauthorized modification (I:H); (8) high availability impact from deletion (A:H). The score lands in the HIGH band due to the dual impact on data integrity and service availability, offset slightly by the authentication requirement.

Frequently asked questions