CVE-2026-77769

CVE-2026-77769 is an IDOR in a dashboard reports endpoint that exposes one organization's reports to another. The router accepts both `projectId` and `dashboardId` as parameters, runs `enforceAccess` middleware on `projectId` to verify membership, and then — critically — discards `projectId` entirely and passes only `dashboardId` to the query. An authenticated user with a valid session can retrieve any organization's dashboard reports by simply supplying a `dashboardId` from a different tenant. What makes this analytically significant is that the secure implementation already existed in the same service file. The function `listReportsCore` correctly resolves the dashboard through `getDashboardById(dashboardId, projectId)` before returning reports, ensuring the parent scope is enforced at the database layer. The developer who wrote the router either knew this helper and chose not to use it, or was unaware of it despite it living in the same file. Neither scenario is a traditional 'developer didn't know about IDOR' gap — both point to a coordination or process failure. The pattern deserves a name: parameters written to satisfy middleware while being excluded from the actual query. This is 'compliance optics' — code that looks authorized because it includes the right middleware and accepts the right parameters, but fails at the point the parameter must actually gate the data. The presence of `enforceAccess` likely created a false sense of security during code review. The middleware did its job; the router just didn't pass the verified scope downstream. Static analysis tools struggle here because `dashboardId` isn't obviously user-controlled — it passes through what looks like a validated access path. A narrow rule could catch this: flag any database query function that accepts a foreign-key-style ID (dashboardId, userId, orgId) without also accepting and using the parent scope ID in its WHERE clause when called from a context that has both. This requires modeling containment relationships, which most generic taint analysis cannot do. The CVSS 6.5 score understates the risk. Exploitation requires only a valid session plus one other organization's dashboard ID — the technical barrier is negligible. Cross-tenant disclosure of business metrics and organizational intelligence has severe practical consequences that the current score structurally cannot capture. The pattern has likely propagated to other routers in the codebase; treat this as a family of vulnerabilities, not a single instance. Verify your own services: audit any endpoint that accepts both a scope ID (projectId, orgId) and a child ID (dashboardId, resourceId), runs authorization middleware on the scope, but queries the database using only the child ID. This is the signature of the 'compliance optics' failure.

Reviewed through automated stages and approved by a human before publication.