{"id":"CVE-2026-108711","summary":"Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces","details":"Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because get_or_create_workspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces endpoint to retrieve workspace metadata and configuration, including custom_instructions, reserved for workspace or admin keys.","modified":"2026-10-14T02:30:42.324999352Z","published":"2026-10-11T12:19:25.400Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108711.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-863"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108711.json"},{"type":"ADVISORY","url":"https://hackmd.io/@haind/honcho-scoped-jwt-workspace-config-disclosure"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108711"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/plastic-labs-honcho-through-3.3.0-incorrect-authorization-via-post-v3-workspaces"},{"type":"PACKAGE","url":"https://github.com/plastic-labs/honcho"},{"type":"ARTICLE","url":"https://github.com/plastic-labs/honcho/blob/608aec8a928da13c540262ed980c569448fb53ab/src/crud/workspace.py#L112-L119"},{"type":"ARTICLE","url":"https://github.com/plastic-labs/honcho/blob/608aec8a928da13c540262ed980c569448fb53ab/src/routers/workspaces.py#L41-L72"},{"type":"ARTICLE","url":"https://github.com/plastic-labs/honcho/blob/608aec8a928da13c540262ed980c569448fb53ab/src/security.py#L218-L225"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/plastic-labs/honcho","events":[{"introduced":"0"},{"fixed":"608aec8a928da13c540262ed980c569448fb53ab"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"3.3.0"},{"fixed":"3.3.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v3.2.2","v3.2.1","v3.2.0","v3.1.2","v3.1.1","v3.1.0","v3.0.12","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v2.5.1","v2.5.0","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.3","v2.3.2","v2.3.1","v2.3.0","v2.1.1","v2.1.0","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.1.0","v1.0.0","v0.0.16","v0.0.15","v0.0.14","v0.0.13","v0.0.12","v0.0.11","v0.0.10","v0.0.9","v0.0.8","v0.0.7","v0.0.6","v0.0.5","v0.0.4","v0.0.3","v0.0.2","v0.0.1","archive-v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108711.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}