CVE-2026-77780

The CVSS 5.3 score for CVE-2026-77780 is misleading. This isn't a typical Insecure Direct Object Reference where an attacker guesses a record ID — it's a structurally deeper failure: the transaction save endpoint accepts `bank_account_id` and `bank_card_id` as user-submitted parameters without validating that those foreign keys belong to the authenticated user's tenant. The system persists these cross-tenant references and renders them in transaction data, creating both an enumeration vector (discover other companies' banking relationships by varying submitted IDs) and a compound persistence risk (the contaminated references become part of your tenant's permanent data store). The exposed data is specific and sensitive: bank account names, bank names, and card last four digits. This is exactly the information used in business email compromise and invoice fraud — not just reconnaissance for lateral movement, but the raw material for financial impersonation. The vulnerability survived across approximately fifteen versions (through 5.14.0), which signals that tenant isolation on foreign key references was never enforced at the framework level. Each endpoint that accepts entity identifiers as parameters became a place where developers had to remember to assert ownership — and memory-based security fails systematically. The critical distinction this CVE introduces is between endpoint hardening and actual remediation. Even after patching the transaction save endpoint to validate tenant ownership, the historical contamination remains. Cross-tenant foreign keys already committed to your database during the vulnerable period don't vanish on patch deployment. Those records may have propagated to exports, backups, audit logs, or third-party integrations. The remediation window doesn't close until someone audits existing transaction records for cross-tenant references and cleans that data — a data hygiene operation that organizations consistently treat as equivalent to a code patch but fundamentally isn't. Additionally, this flaw almost certainly isn't isolated to these two parameters. If the framework treats foreign key submission as user-controllable input rather than scoping references to the tenant context by default, every other foreign key field in the transaction endpoint — and likely across other endpoints — carries the same implicit trust model. Audit every endpoint that accepts entity references as parameters and verify tenant ownership validation exists at the persistence layer, not just at the direct object access layer.

Reviewed through automated stages and approved by a human before publication.