Dashboard / CVE-2026-57956

CVE-2026-57956

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 62/100
Published: 2026-06-29 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
AT: None
VC: Low
VI: High
VA: Low

Description

SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
SigNoz signoz 0 < 0.133.0

References & Advisories (4)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.35%
Raw Score 0.003530
Percentile 29.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00353
2026-11-12
0.00353
2026-11-10
0.00353
2026-11-09
0.00353
2026-11-08
0.00353

Intelligence Sources

mitre ref →

External Links