GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-116068: Cross Tenant Service Access Missing Organization Scope Checkcve-2026-116068-cross-tenant-service-access-missing-organization-scope-check

$FUNC authorizes a caller-supplied service/project id without ever verifying that the target resource belongs to ctx.session.activeOrganizationId (missing object-level tenant authorization, CWE-639/BOLA). It only resolves the caller's own member record, applies role/RBAC statements via checkPermission, and enforces the per-user allowlist solely for non-owner

TSCVE-2026-116068CWE-639
by Provallyupdated 2026-10-27Apache-2.0
450 direct45 via packs
80
All matching rules loaded.