CVEvulnerability
CVE-2026-105140
2.3 LOW
Official page ↗
- Status
- Deferred
- Published
- 2026-10-07
- Last modified
- 2026-10-07
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 2.3 LOW — CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 4.2 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-362
Description
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- https://github.com/obot-platform/obot github.com
- https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/group.go#L652-L734 github.com
- https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/identity.go#L444-L456 github.com
- https://github.com/obot-platform/obot/blob/6f81dac8d344cf6b2161f500460fb7b2a975c415/pkg/gateway/client/group.go#L741-L757 github.com
- https://github.com/obot-platform/obot/commit/09e4d5b5d1e4a5f35a6cbcff96f3c460c3f9e278 github.com
- https://github.com/obot-platform/obot/commit/6f81dac8d344cf6b2161f500460fb7b2a975c415 github.com
- https://github.com/obot-platform/obot/releases/tag/v0.26.1 github.com
- https://github.com/obot-platform/obot/security/advisories/GHSA-929v-v9hq-5xhr github.com
- https://www.vulncheck.com/advisories/obot-0.25.0-before-0.25.6-and-0.26.0-before-0.26.1-race-condition-restores-revoked-group-membership www.vulncheck.com