CVE-2026-80209

Name of the Vulnerable Software and Affected Versions Fonoster versions prior to 0.22.8

Description The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts fails to terminate execution after invoking a gRPC callback with a PERMISSION DENIED error when a user is not a member of the target workspace. Consequently, the process continues to prisma.workspace.update, allowing the workspace rename to be committed despite the permission error. This occurs because the gRPC interceptor in mods/common/src/identity/createAuthInterceptor.ts assigns Identity/UpdateWorkspace to fullIdentityAccess, a permission held by the base USER role, rather than restricting it to workspaceResourceAccess or workspaceResourceOwnerOrAdminAccess. As a result, any authenticated user can rename any workspace within the deployment.

Recommendations Update Fonoster to version 0.22.8 or later.