CVE-2026-74869

CVE-2026-74869 is a broken object-level authorization (BOLA) flaw in a pub/sub event distribution system, and the 'authenticated attacker' framing obscures more than it reveals. The Subscribe handler processes server IDs as opaque parameters without validating that the requesting principal has any membership relationship with that server. This is architecturally distinct from a typical IDOR—in this case, an attacker establishes a live subscription channel that continuously pushes UserUpdate events (display names, avatars, status transitions) for members they should never know exist. The authentication requirement deserves skepticism. If the platform permits open account registration, the practical impact approaches unauthenticated exposure in threat models where your adversary can create an account. The relevant question is whether this requirement meaningfully bounds the attack surface or merely excludes external actors with no credentials at all. What elevates this beyond a typical enumeration flaw is the surveillance dimension. Traditional member enumeration yields a static list; this grants an ongoing feed of member activity. For targeting purposes—identifying which members of a private organization are currently active, tracking when specific individuals change their status or avatar—this capability is qualitatively different. The confidentiality impact should be evaluated not just against disclosed data volume but against the duration and continuity of access. This vulnerability follows a recurring pattern in pub/sub systems: topic enumeration was the first generation (patched by authenticating before publishing), subscriber validation was the second (publisher checks identity), and now subscription-authorized delivery leaks metadata about who belongs to what. Each generation adds a check closer to the data, but the underlying assumption—that authorization can be bolted onto an open subscription model—remains unchallenged. Expect the patch to add a membership check in the Subscribe handler, likely in version 0.15.0. Watch for related handlers (Unsubscribe, TopicList) or new integration points that re-export the same data through different channels. The deeper concern: this handler wasn't broken—it was forgotten. The pub/sub subscription primitive shipped with its open-topic mental model intact, and membership validation was deferred as 'coming in the next sprint.' That deferred work became sediment: code that looks functional, passes tests, and sits in production while everyone assumes someone else handled the access control. If this handler was forgotten, other handlers likely were too. Presence queries, channel topic lookups, and role enumeration may share the same absent validation.

Reviewed through automated stages and approved by a human before publication.