{"id":"CVE-2026-57956","summary":"SigNoz \u003c 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules","details":"SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.","modified":"2026-07-22T05:32:26.444387639Z","published":"2026-06-29T17:22:45.706Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57956.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-639"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57956.json"},{"type":"ADVISORY","url":"https://github.com/SigNoz/signoz/releases/tag/v0.133.0"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57956"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/signoz-cross-organization-insecure-direct-object-reference-in-alert-rules"},{"type":"REPORT","url":"https://github.com/SigNoz/signoz/issues/11830"},{"type":"REPORT","url":"https://github.com/SigNoz/signoz/pull/12117"},{"type":"PACKAGE","url":"https://github.com/SigNoz/signoz"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/signoz/signoz","events":[{"introduced":"0"},{"fixed":"0c28b8b25125448935f760c448d9511683c40857"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"0.133.0"}]}}],"versions":["v0.132.2","v0.132.1","v0.132.0","v0.132.0-rc.2","v0.131.1","v0.132.0-rc.1","v0.131.0","v0.130.1","v0.130.0","v0.129.0","v0.128.0","v0.127.1","v0.127.0","v0.126.3-rc.1","v0.126.1","v0.126.0","v0.125.1","v0.125.0","v0.124.0","v0.123.0","v0.122.0","v0.121.1","v0.121.0","v0.120.0","v0.119.0","v0.118.0","v0.117.1","v0.117.0","v0.116.0","v0.116.1","v0.115.0","v0.114.1","v0.114.0","v0.113.0","v0.113.0-rc.1","v0.112.1","v0.112.0","v0.111.0","v0.110.1","v0.110.0","v0.109.3","v0.109.2","v0.109.1","v0.109.0","v0.108.0","v0.108.0-rc.1","v0.107.0","v0.106.0","v0.105.1","v0.105.0","v0.104.0","v0.104.0-cloud.1","v0.103.1","v0.103.0","v0.102.1","v0.102.0","v0.101.0","v0.101.0-rc.1","v0.100.1","v0.100.0","v0.99.0","v0.98.0","v0.98.0-rc.1","v0.98.0-rc.0","v0.97.1","v0.97.0","v0.97.0-rc.3","v0.97.0-rc.2","v0.97.0-rc.1","v0.96.1","v0.96.0","v0.95.1-cloud.1","v0.95.1","v0.95.0","v0.94.1-cloud.1","v0.94.0","v0.94.1","v0.93.0-cloud.3","v0.93.0-cloud.2","v0.93.0-cloud.1","v0.93.0","v0.93.0-rc.1","v0.93.0-rc.3","v0.93.0-rc.2","v0.92.2","v0.92.1","v0.92.0","v0.91.1","v0.92.0-rc.5","v0.92.0-rc.1","v0.92.0-cloud.1","v0.91.0","v0.90.1","v0.90.0","v0.89.0","v0.88.1","v0.88.0","v0.88.0-rc.1","v0.89.0-cloud.1","v0.88.0-cloud.3","v0.88.0-cloud.2","v0.88.0-cloud.1","v0.87.0-rc.1","v0.87.0","v0.86.2","v0.86.1","v0.86.0","v0.85.3","v0.85.2","v0.85.1","v0.85.0","v0.84.1","v0.84.0","v0.83.0","v0.83.0-cloud.1","v0.82.1","v0.82.0","v0.82.0-cloud.1","v0.81.0","v0.80.0","v0.79.1","v0.80.0-cloud.1","v0.79.0","v0.78.0","v0.78.1","v0.78.0-3142b6cc6","v0.78.0-cloud.1","v0.77.0","v0.77.0-cloud.2","v0.76.2-ac7ecac2","v0.76.2","v0.76.1","v0.77.0-cloud.1","v0.76.0","v0.76.0-cloud.4","v0.76.0-cloud.3","v0.76.0-cloud.2","v0.76.0-cloud.1","v0.75.0","v0.75.0-cloud.1","v0.74.0","v0.74.0-cloud.1","v0.73.0-407654e6","v0.73.0","v0.73.0-cloud.3","v0.73.0-cloud.2","v0.73.0-cloud.1","v0.72.0","v0.72.0-cloud.4","v0.72.0-cloud.3","v0.72.0-cloud.2","v0.72.0-cloud.1","v0.72.0-aws-integration-c3164912e","v0.71.0","v0.71.0-cloud.2","v0.70.1","v0.71.0-cloud.1","v0.70.0","histogram-quantile/v0.0.1","v0.69.0","v0.69.0-cloud.2","v0.69.0-cloud.1","v0.68.0","v0.67.1","v0.67.0","v0.67.0-custom-domain-15f85a645","v0.66.0","v0.65.1","v0.65.0-cloud.7","v0.65.0","v0.65.0-cloud.6","v0.65.0-cloud.5","v0.65.0-cloud.4","v0.65.0-cloud.3","v0.65.0-cloud.2","v0.64.0","v0.55.0","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","v0.3.6","v0.3.5","0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.2.2","0.2.2","0.2.0","0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57956.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"}]}