CVE-2026-92764 opencve CVE debrief

Who should care

Defenders and administrators using OpenCVE, especially those with organization-scoped tokens, should assess exposure and consider upgrading to OpenCVE 3.1.0 or later. Users with organization-scoped tokens should evaluate token scope and permissions, and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should care about CVE-2026-92764 because it allows attackers to bypass token isolation boundaries in OpenCVE before 3.1.0, potentially leading to unauthorized access to organization information. Users with organization-scoped tokens should assess exposure and consider upgrading to OpenCVE 3.1.0 or later.

• Potential unauthorized access to organization information
• Bypassing of token isolation boundaries
• Possible lateral movement within organizations

Technical summary

The organizations API endpoint in OpenCVE before 3.1.0 does not properly scope to the token's organization, allowing attackers with organization-scoped tokens to list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries. This issue potentially leads to unauthorized access to organization information. Defenders should prioritize verifying the OpenCVE version and assessing exposure, especially for users with organization-scoped tokens. The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification.

Defensive priority

Defenders should prioritize verifying the OpenCVE version and assessing exposure, especially for users with organization-scoped tokens.

Recommended defensive actions

• Verify OpenCVE version and assess exposure
• Evaluate token scope and permissions
• Consider upgrading to OpenCVE 3.1.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification. OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries. Defenders should verify the OpenCVE version and assess exposure, especially

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.