CVE-2026-7573: Cve 2026 7573 User Context Identity Discarded No Authz
Both meaningful return values from GetUserFromContext (user record and org config) are discarded via blank identifiers. Without capturing the calling principal, no object-level authorization check is possible before using caller-supplied request parameters to access protected resources, enabling IDOR (CWE-639). Capture the user record, extract the principal,
Gogreprules fetch cve-2026-7573-cve-2026-7573-user-context-identity-discarded-no-authz --engine opengrepDescription
Both meaningful return values from GetUserFromContext (user record and org config) are discarded via blank identifiers. Without capturing the calling principal, no object-level authorization check is possible before using caller-supplied request parameters to access protected resources, enabling IDOR (CWE-639). Capture the user record, extract the principal,
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.