CVE-2026-80209 fonoster CVE debrief

Who should care

Fonoster deployment administrators and security teams should assess exposure and apply updates to prevent unauthorized workspace renames. Any authenticated user can rename an arbitrary workspace in the deployment due to improper authorization checks in the updateWorkspace handler.

Why it matters

CVE-2026-80209 is a medium-severity vulnerability in Fonoster that allows any authenticated user to rename an arbitrary workspace due to improper authorization checks in the updateWorkspace handler. This could lead to unauthorized modifications and potential disruptions in workspace management. Fonoster deployment administrators and security teams should assess exposure and apply updates to prevent unauthorized workspace renames.

• Authenticated users can rename arbitrary workspaces, potentially disrupting workspace management.
• Workspace rename operations may be used to obscure malicious activity.
• Verification of workspace access controls and monitoring for suspicious rename activities are necessary.

Technical summary

The updateWorkspace handler in Fonoster through 0.22.7 does not properly check if the caller is a member of the target workspace before allowing a rename operation. This is due to the gRPC callback being invoked with PERMISSION_DENIED but the execution continuing into prisma.workspace.update, which commits the rename before the second callback is issued. The gRPC interceptor in mods/common/src/identity/createAuthInterceptor.ts binds the workspace accessKeyId to the caller's token only for paths in workspaceResourceAccess or workspaceResourceOwnerOrAdminAccess, and Identity/UpdateWorkspace is listed in fullIdentityAccess, which the base USER role holds.

Defensive priority

Assess exposure and apply updates for Fonoster deployments, focusing on authentication and workspace management.

Recommended defensive actions

• Assess Fonoster deployment exposure and update to a fixed version if available.
• Review workspace management and authentication configurations.
• Monitor for suspicious workspace rename activities.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which is caused by the updateWorkspace handler's improper authorization checks. The gRPC interceptor in mods/common/src/identity/createAuthInterceptor.ts binds the workspace accessKeyId to the caller's token only for paths in workspaceResourceAccess or workspaceResourceOwnerOrAdminAccess, and Identity/UpdateWorkspace is listed in fullIdentityAccess, which the base USER role holds. Any authenticated user can therefore rename an arbitrary workspace in the deployment. The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.