PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110621 Swetrix CVE debrief

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation, potentially leading to unauthorized access or changes. This vulnerability affects instances with multiple organisations and projects, requiring defenders to assess exposure and potential impact. The issue arises from inadequate authorization checks in the ProjectController.addProject method.

Vendor
Swetrix
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders managing Swetrix Cloud instances, especially those with multiple organisations and projects, should assess exposure and potential impact. This includes reviewing instance versions, project permissions, and organisation memberships to prevent unauthorized access or changes. Security teams responsible for Swetrix Cloud deployments should prioritize verifying instance exposure and implementing necessary mitigations.

Why it matters

Defenders should care about CVE-2026-110621 as it allows authenticated users to hijack arbitrary projects in Swetrix Cloud before 5.1.0, potentially leading to unauthorized access or changes.

  • Potential unauthorized access to project analytics
  • Possible changes to project settings
  • Potential deletion of projects
  • Verification of instance version and exposure required

Technical summary

The vulnerability is in ProjectController.addProject and allows authenticated users to move projects into their own organisation, potentially gaining unauthorized access to project analytics, settings, or deletion capabilities. This issue arises from insufficient authorization checks, allowing attackers to hijack projects by adding them to their own organisation. Defenders should focus on verifying exposure and assessing potential impact on Swetrix Cloud instances, especially those with multiple organisations and projects.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on Swetrix Cloud instances, especially those with multiple organisations and projects.

Recommended defensive actions

  • Verify Swetrix Cloud instance version and check if it is 5.1.0 or later
  • Assess exposure of instances with multiple organisations and projects
  • Review project permissions and organisation memberships
  • Consider upgrading to Swetrix Cloud 5.1.0 or later
  • Monitor for suspicious project changes or unauthorized access
  • Perform a thorough review of organisation and project configurations
  • Implement additional logging and monitoring for project-related activities

Evidence notes

The vulnerability allows authenticated users to move projects into their own organisation, potentially gaining unauthorized access to analytics, settings, or deletion capabilities. This issue is particularly concerning for instances with multiple organisations and projects, as it could lead to significant unauthorized access or changes. Defenders should verify instance version and exposure, especially in environments with multiple organisations and projects.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110621 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110621

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110621 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110621

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110621.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Swetrix/swetrix/issues/477

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Swetrix/swetrix/blob/v5.0.3/backend/apps/cloud/src/project/project.controller.ts

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Swetrix/swetrix/commit/63eb76edcb446402ad1db5ff870920773f5ff588

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Swetrix/swetrix/releases/tag/v5.1.0

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/swetrix-cloud-before-5.1.0-missing-authorization-via-post-project-organisation-orgid

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.