CVE-2026-56767: Maxun Cross-Tenant IDOR in Storage & Webhook APIs (CVSS 8.8)

Technical summary

CVE-2026-56767 exploits insufficient access control in Maxun's storage and webhook API handlers. The vulnerability stems from CWE-862 (Missing Authorization) and manifests as a cross-tenant insecure direct object reference (IDOR). Authenticated API requests can bypass object ownership checks, allowing an attacker to enumerate and manipulate resources (robots, OAuth tokens, webhook configurations) across tenant boundaries. The plaintext storage and exposure of third-party credentials (Google, Airtable tokens) compounds the severity. No special privileges or user interaction is required; the flaw is directly exploitable via REST API calls with valid authentication credentials.

Business impact

This vulnerability creates a multi-layered business risk. Customer data security is compromised: OAuth tokens for Google and Airtable accounts are accessible to other platform users, enabling further downstream attacks on those SaaS accounts. Automation integrity is at risk: attackers can silently modify or delete customer robots, causing service disruption and data loss. Compliance exposure is significant—unauthorized access to other customers' credentials and workflows likely violates SOC 2, GDPR, and contractual data protection obligations. Reputational damage follows from evidence of weak multi-tenancy isolation, particularly damaging for a workflow automation platform handling sensitive integrations.

Affected systems

Maxun prior to version 0.0.42 is affected. The vulnerability impacts all deployments of Maxun where the storage and webhook API endpoints are accessible to authenticated users. No specific product variants, optional features, or deployment models are exempt; the flaw is inherent to the authentication and authorization architecture of the affected versions.

Exploitability

Exploitability is very high. An attacker needs only valid Maxun user credentials (obtained through legitimate signup, social engineering, or credential compromise) to trigger the vulnerability. The IDOR pattern is straightforward: modify object IDs in API requests to access other users' robots and tokens. No special tools, authentication bypass, race conditions, or user interaction are required. The attack surface is broad—any authenticated user can scan for valid object IDs and harvest credentials. Real-world attack scenarios include credential theft from integration services, sabotage of business workflows, and lateral movement into connected Google or Airtable accounts.

Remediation

Upgrade Maxun to version 0.0.42 or later immediately. This version includes authorization fixes that enforce ownership checks on all storage and webhook API endpoints. Organizations must also rotate any exposed OAuth tokens (Google and Airtable) that may have been accessed during the vulnerable window, audit API logs for suspicious cross-tenant access patterns, and review webhook configurations for unauthorized modifications. Consider implementing additional network-level access controls and API usage monitoring as a defense-in-depth measure.

Patch guidance

Maxun 0.0.42 contains the corrective patches. Deployment of this version is strongly recommended without delay. Verify the patch has been applied by checking the Maxun version string in your environment and confirming API responses reflect the updated authorization logic. If you are running a version between the initial release and 0.0.41, you are vulnerable. Staged or canary rollouts are not necessary given the severity, but standard change management processes should be followed. No configuration changes or manual workarounds mitigate the underlying issue—patching is the only remediation.

Detection guidance

Hunt for indicators of compromise by reviewing API access logs for patterns consistent with IDOR exploitation: a single user account accessing robot or token objects with many different object IDs in short timeframes, API calls to endpoints from users who don't own those resources, and unusual modifications or deletions of robots by non-owning accounts. Monitor for authentication patterns from unfamiliar IP addresses or geographic regions. Check audit logs for webhook reconfigurations that don't align with known administrative activity. Export and review plaintext OAuth tokens stored in your Maxun instance to identify if any have been accessed or rotated by unauthorized parties. If Maxun exposes API request logging, correlate user identity with resource ownership claims.

Why prioritize this

This vulnerability merits immediate remediation. The CVSS 8.8 HIGH score reflects the combination of network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability. The flaw is easy to exploit without special privilege, affects the core multi-tenancy boundary of the platform, and directly exposes sensitive third-party credentials. Unlike vulnerabilities that require privilege escalation or social engineering, this one is trivially exploitable by any user with platform access. For organizations using Maxun to orchestrate integrations with critical business systems, this vulnerability could enable destructive or espionage-class attacks.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: AV:N (network-accessible API endpoints), AC:L (no special conditions required), PR:L (valid user credentials needed but commonly available), UI:N (no user interaction required), S:U (impact is scoped to the affected system), C:H (plaintext credential disclosure), I:H (ability to modify or delete other users' robots), and A:H (ability to disrupt service availability through resource deletion). The score appropriately captures the severity of cross-tenant access control bypass in a platform handling OAuth credentials and business-critical automation workflows.

Frequently asked questions