Augmentt: Cross-Tenant Access via IDOR

Credits

This CVE was a collaborative effort between:
Raznov – GitHub: https://github.com/basraznov
HelloWorld (Author)– GitHub: https://github.com/Penquinsecq

Description

A vulnerability in the web application allows unauthorized users to access and manipulate sensitive data across different tenants by exploiting insecure direct object references. This could lead to unauthorized access to sensitive information and unauthorized changes to the tenant's configuration.

[!CAUTION]This research is published for educational and defensive purposes. The vulnerabilities were disclosed responsibly and coordinated prior to publication.

Product: Augmentt Web Application
Version: Unknown version but release before October 2025
Date: 02-October-2025
Software Link: https://app.augmentt.com/
CVE ID: CVE-2026-6355
Category: Web Application\

Steps to Reproduce

1. Log in as a user (User1)
2. Navigate to the companies menu to retrieve customerid
3. Navigate to any function that creates or modifies resources
4. Intercept the HTTP request using a proxy tool
5. Modify the customerid parameter to another tenant’s ID
6. Forward the request

Proof of Concept

Please find in PDF file.

Impact

• Cross-tenant access
• Unauthorized resource creation
• Potential account creation in other tenants

Timeline

Vendor Response

At the time of writing, the vendor has not responded to multiple disclosure attempts.

Mitigation

Recommended fixes: Before processing any request that uses an external identifier (like customerid) the backend must perform a mandatory check. This check must ensure that the authenticated session's user ID is explicitly authorized to access the requested resource ID. If the user ID does not match the resource's owner ID, the server must reject the request and return a generic error (e.g., HTTP 404 Not Found or HTTP 403 Forbidden).

References

• KB CERT: [If published]

Maintainers:

• HelloWorld (https://github.com/Penguinsecq)
• Raznov (https://github.com/basraznov)