CVE-2026-80209
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Fonoster up to 0.22.7 allows an authenticated user to rename any workspace. The updateWorkspace handler does not stop execution after reporting lack of membership, and access control does not cover this operation.
Risk Assessment
An authenticated user can rename any workspace, potentially leading to data integrity issues and service disruption.
Recommendation
Update Fonoster to a patched version or apply a workaround by restricting access to the UpdateWorkspace operation.
Original NVD description (English source)
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues into prisma.workspace.update, which is scoped by the workspace reference alone, so the rename commits before the second callback is issued and the caller receives a permission error for a write that already succeeded. The gRPC interceptor in mods/common/src/identity/createAuthInterceptor.ts binds the workspace accessKeyId to the caller's token only for paths in workspaceResourceAccess or workspaceResourceOwnerOrAdminAccess, and Identity/UpdateWorkspace is listed in fullIdentityAccess, which the base USER role holds. Any authenticated user can therefore rename an arbitrary workspace in the deployment.