Description
Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| meteroid-oss | Meteroid | < 2.2.0 | 2.2.0 |
References
- https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2 patch
- Meteroid v2.2.0 Release Notes release-notes
- https://github.com/meteroid-oss/meteroid/blob/v2.1.0/modules/meteroid/crates/diesel-models/src/query/coupons.rs#L472-L486 technical-description
- https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor third-party-advisory
- VulnCheck Advisory: Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus third-party-advisory