The isolation boundary is only as strong as its weakest read.
We source-review self-hostable AI and SaaS products for cross-tenant and cross-user isolation failures, the class of bug where one customer, workspace, department, or user can read, modify, or delete another's data. We report findings privately to the maintainer and publish them here once a fix ships.
Two instruments, kept separate. Every number above comes
from source review, reading code for one pattern. The product does
something different: it never reads code at all.
Sectum AI plants canary data in synthetic
tenants and verifies at runtime what a running stack actually returns,
which is the only way to reach the surfaces review cannot see, the vector
store, retrieval, the cache, an agent's memory. Twelve targets have a
signed, independently anchored evidence pack from those runs, and every
one of them still re-verifies with sectum-ai verify.
The un-retrofitted sibling
Cross-tenant bugs rarely look like missing auth. They look like a scope check that was built correctly, and wired into the writes, the deletes, and the list views, but skipped on one by-id read that reuses the same query. The read still returns the row; it just forgot whose row it was.
tenant_id or user_id predicate), wired into the writes and lists, and skipped on a single by-id read. That read now returns any tenant's, or any user's, record by id.Find the guard. Locate the tenant / owner check the codebase already uses: a WHERE tenant_id predicate, a @CheckOwner, a has_perm() call.
Diff its call-sites. Compare where it fires against where it doesn't: the by-id reads, deletes, and LLM-tool calls versus the writes and lists.
Prove it at the source. Every finding is source-confirmed at a specific commit and adversarially re-verified, usually with a one-to-two-line fix attached.
Teams retrofit their write and list paths first after an IDOR wave, so the by-id read, delete, and LLM-tool siblings are where cross-tenant and cross-user access survives.
Disclosed & fixedFindings with a public fix
Findings where the maintainer has shipped a public fix. Advisories still under coordinated disclosure are aggregated below and named here as each patch lands.
| Product | Finding | Reference |
|---|---|---|
| KubePi 1Panel-dev | Insufficient per-cluster authorization in cluster-management APIs (cross-cluster takeover) | CVE-2026-69129 · GHSA-cwg7-34p9-9hxh (published) · fixed in 2.0.1 |
| AnythingLLM Mintplex-Labs | Cross-workspace exposure via the public embed widget | CVE-2025-63390 · PR #5759 (merged) |
| SurfSense MODSetter | Connector-index cross-tenant authorization bypass (stored OAuth / PAT exfiltration) | PR #1503 (merged & deployed) |
| Baserow baserow | Cross-workspace field-data disclosure (IDOR) | PR #5613 (fixed & deployed) · CVE pending |
| aideepin moyangzhan | Cross-user knowledge-base embedding read (RAG chunk disclosure) | PR #105 (merged) · issue #104 |
| Flagsmith Flagsmith | Cross-project read of another project's multivariate-flag values (nested-viewset IDOR); the fix swept four sibling viewsets | PR #7945 (merged) |
Reported privately, published on fix
Alongside the fixed findings above, Sectum AI has filed 30+ GitHub Security Advisories (credited to our team) and emailed maintainers directly for a further set of unpatched cross-tenant issues, including several Critical-severity account-takeover and unauthenticated data-exposure flaws. Each stays private until the vendor ships a fix, at which point we add it here with its CVE / advisory link.
- AcceptedAn advisory validated by the maintainer and published as CVE-2026-69129 (Moderate), with a fix we contributed upstream.
- ReproducedReports independently acknowledged and reproduced by vendor security teams.
- In triageAdvisories moving toward coordinated publication, named here as each patch ships.
Check back as fixes land, or get in touch for current status.
Same bug class, your productFound a cross-tenant bug in your product?
This research is source review. What we run for customers is the other instrument: Sectum AI provisions synthetic tenants, plants canary markers, and proves at runtime what your stack actually returns, on the surfaces source review cannot reach. See how Sectum AI works, the threat model, and the engagement options. We disclose responsibly and include the fix.