CVE-2026-92716
CriticalCVSS 9.6Summary
Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover across tenant boundaries.
Risk Assessment
An administrator in one organization can take over user accounts in other organizations, breaching tenant isolation and potentially leaking data. This may lead to serious security and compliance consequences.
Recommendation
Update Shuffle to a version later than 2.2.1 if available, and enforce tenant-based access control in the HandleApiGeneration endpoint. Until patched, restrict administrator privileges and monitor unusual API key activity.
Other vulnerabilities in Shuffle
Original NVD description (English source)
Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover across tenant boundaries.