CVE-2026-119663

MediumCVSS 4.3

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler. An authenticated user can attach resources to other users' connections by including a victim's connectionId in a batch request.

Risk Assessment

An attacker can inject attacker-named resources into a victim's connections, compromising data integrity and potentially exposing information. Only an account and one owned connection are required.

Recommendation

Upgrade Tamery to version 0.99.0 or later. Additionally verify that resource operations enforce authorization on the target connection.

Other vulnerabilities in Tamery

CVE-2026-119664Medium
Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.

Original NVD description (English source)

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS