CVE-2026-89112
6.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-862
Impact
Authenticated low-privileged users can read CLA signature records and contributor details across other organizations. An attacker only needs basic network access and a valid account.
Root cause
The admin API endpoint fails to enforce authorization checks when querying CLA signature records by organization ID.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade cla-assistant to the fixed release specified in GHSA-8rcv-xqgf-8743. If patching immediately is not possible, restrict network access to the admin API endpoint.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.