CVE-2026-67329

This vulnerability is an authorization bypass in multi-tenant contexts where the middleware validates one source of organization context (req.query.organizationId) while the handler acts on a different source (req.body.organizationId with session fallback). Neither layer is individually flawed — the gap between them is the exploit surface. The critical flaw is the session fallback. When the request body lacks an explicit organizationId, the handler silently substitutes whatever organization is active in the user's session. This transforms session state — a convenience mechanism for UI workflow — into an authorization decision. In single-organization deployments this never manifests. In multi-tenant systems where users legitimately belong to multiple organizations, this fallback lets an attacker invoke actions against an organization they can see in their session but lack explicit authorization for. For defenders: verify whether your deployment uses multi-tenant organization routing. Check if any handler in your integration layer reads organizationId from req.body with a session fallback rather than requiring it explicitly from a validated source. The patch should enforce that req.body.organizationId must be present and must be validated against the user's authorized organization set — no silent fallback. If the handler receives an org ID that differs from the session context, that should trigger explicit re-verification rather than implicit trust transfer. Prioritize this based on your tenant architecture: the CVSS score understates the risk in multi-tenant contexts with financial data. Compromised billing access creates cascading exposure across payment instruments, subscription state, and regulatory compliance. Even a 7.1-rated finding warrants immediate attention when it touches financial infrastructure.

Reviewed through automated stages and approved by a human before publication.