fonoster CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM fonoster CVE published 2026-08-27

CVE-2026-80209

Fonoster through 0.22.7 contains an authorization bypass in the updateWorkspace handler, allowing any authenticated user to rename an arbitrary workspace. This vulnerability is caused by improper authorization checks, where the gRPC callback is invoked with PERMISSION_DENIED but execution continues into prisma.workspace.update, committing the rename before the second callback is issued. Fonoster deploymen [truncated]