PT-2026-36630

تاريخ النشر

2026-04-22

·

تاريخ التحديث

2026-04-22

الوصف من

CVSS 4.0
8.7
عالية
المقاييسAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Summary

When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can simply append /tenant/create to their tenant URL. The system reads the role from the tenant context (admin), and a new tenant is created on the root domain (in PUBLIC SCHEMA > sc tenants), rather than in the tenant's own sc tenants table.
If the same logic applies to other routes, a tenant admin effectively gains admin rights on the root domain.

PoC

A tenant-created subtenant appears under the Saltcorn public schema instead of the tenant's own schema.
  • Even when role id=1 is required for tenant creation on saltcorn.com (only admin can create tenants), existing tenant admins can still create new tenants because their local role id:1 is evaluated against the root domain.
  • Even when role to create tenant is set to 0 in the tenant's sc config schema, or removed entirely, the tenant admin can still create sub-tenants on the root domain — suggesting role to create tenant is not being read at all.

Impact

Tenant admins gain unauthorized admin-level access to the root domain. Any authenticated tenant admin can perform privileged operations (e.g., creating tenants) on the root domain by exploiting the role context mismatch.
قابلية الاستغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
تصنيف نقاط الضعف
CWE-863: Incorrect Authorization
المعرّفات ذات الصلة
GHSA-9237-RG5P-RHFW
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
dbugs@ptsecurity.com