CVE-2026-42142

This CVE exposes a failure mode that plagues growing SaaS platforms: multi-tenancy retrofitted onto a single-tenant codebase. The `handleGetSheets` handler verified that a request was authenticated, then directly returned Google OAuth credentials for any workspace ID passed in the request — without checking whether the authenticated user actually belonged to that workspace. The authentication check was real; the authorization check was absent. This is the 'trust the session, skip the ACL' pattern in its purest form. The severity compounds because the stolen credential is not internal data — it's a Google OAuth token that often includes refresh capabilities. An attacker doesn't need to exploit this at the moment of compromise; they can store the token and maintain persistent access to the victim's Google account long after you patch the handler and rotate credentials. The blast radius extends beyond your remediation surface into Gmail, Drive, and any other Google Workspace integrations the account touches. Audit every API handler that retrieves tenant-scoped secrets — OAuth tokens, API keys, webhook configurations, custom code execution credentials. The pattern to hunt: handlers that correctly enforce authentication but skip workspace membership validation before returning scoped resources. Specifically, grep your codebase for handlers that accept a workspace ID parameter and return secrets without a `workspaceMembershipCheck` or equivalent authorization gate. This is likely not an isolated oversight. If `handleGetSheets` was missed, other handlers using the same implicit trust assumption almost certainly exist. Treat this CVE as evidence of incomplete security boundary mapping during your multi-tenancy migration — not just one patched endpoint.

Reviewed through automated stages and approved by a human before publication.