{"id":"GHSA-c6v2-3ffm-vcmc","summary":"Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)","details":"## Summary\n\nThe web UI (`/ui/*`) does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators.\n\n## Impact\n\nA non-admin operator can:\n\n- **Block or delete any other operator's host.** `POST /ui/hosts/{id}/block` and `DELETE /ui/hosts/{id}` act on the URL `id` with no ownership check, so a non-admin can block (revoking the host's certificate via the blocklist) or delete any host in the deployment — a cross-operator denial of service.\n- **Read every operator's hosts and networks.** The dashboard, `/ui/hosts`, the host detail page, `/ui/networks` (including the create-form error re-render), and the `/ui/events` stream all return data across all operators, exposing host names, Nebula IPs, public IPs, certificate fingerprints and expiry, and network names and CIDRs.\n\nThis is the same cross-operator class as GHSA-598g; that remediation covered the JSON API but not the web read/mutation surface. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped.\n\nAffected handlers (`internal/web`): `handleHostDetail`, `handleHostBlock`, `handleHostDelete`, `handleDashboard`, `handlePartialStats`, `handleHosts`, `handleNetworks`, `renderNetworksError`, `handleHostEvents`.\n\n## Conditions\n\nExposure requires at least one non-admin operator to exist (self-registration enabled, OIDC, or an admin-created user). A single-admin deployment with no additional operators is not affected.\n\n## Fix\n\nA complete candidate fix with regression tests is ready in a private repository shared with the maintainer (`ak2k/nebula-mesh-ghsa-web`, PR #1): scope these handlers to the session operator's owned CAs (admins keep the full view), mirroring the API's ownership checks.","aliases":["CVE-2026-49258","GO-2026-5816"],"modified":"2026-07-07T16:11:03.909300040Z","published":"2026-06-26T21:29:02Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-06-26T21:29:02Z","nvd_published_at":null,"cwe_ids":["CWE-639","CWE-862"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/juev/nebula-mesh/security/advisories/GHSA-c6v2-3ffm-vcmc"},{"type":"PACKAGE","url":"https://github.com/juev/nebula-mesh"}],"affected":[{"package":{"name":"github.com/juev/nebula-mesh","ecosystem":"Go","purl":"pkg:golang/github.com/juev/nebula-mesh"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.3.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c6v2-3ffm-vcmc/GHSA-c6v2-3ffm-vcmc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}