{"uuid": "c12d6b3b-11dc-4713-8d84-5df2bd0d0971", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://gist.github.com/alon710/43186f210d41aaa752fb23f70074de25", "content": "# CVE-2026-59151: CVE-2026-59151: Cross-Tenant Account Takeover via Improper SAML Assertion Validation in Prowler\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59151\n\n## Summary\nA critical authentication bypass and cross-tenant account takeover vulnerability exists in the Prowler cloud security platform due to improper validation of the SAML Assertion Consumer Service (ACS) flow. An authenticated attacker controlling a custom Identity Provider (IdP) can forge assertions targeting arbitrary user identities across distinct tenants, allowing complete unauthorized access to target tenant-scoped resources.\n\n## TL;DR\nAn architectural flaw in Prowler's SAML validation allows attackers to bypass tenant isolation and take over arbitrary victim accounts by manipulating the asserted NameID value in their own custom IdP.\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 9.6\n- **EPSS Score**: 0.00322\n- **Impact**: Cross-Tenant Account Takeover\n- **Exploit Status**: None (No active public exploits)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Prowler Cloud Security Platform < 5.30.3\n- Prowler API < 1.31.3\n- **Prowler**: < 5.30.3 (Fixed in: `5.30.3`)\n- **Prowler API**: < 1.31.3 (Fixed in: `1.31.3`)\n\n## Mitigation\n\n- Upgrade Prowler deployment to version 5.30.3 or higher.\n- Audit existing SAML configurations to verify all active domains correspond to verified organization entities.\n- Monitor application container logs for domain mismatch warnings.\n\n**Remediation Steps:**\n1. Identify the running version of the Prowler API container.\n2. Pull the updated Prowler image with tag 5.30.3 or higher, and Prowler API container with tag 1.31.3 or higher.\n3. Restart the application services to apply the patched code paths.\n4. Execute automated tests of the SAML SSO flow to ensure legitimate organization users can authenticate.\n\n## References\n\n- [GitHub Security Advisory GHSA-h8m9-jgf8-vwvp](https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp)\n- [Prowler Pull Request #11650](https://github.com/prowler-cloud/prowler/pull/11650)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59151) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T00:01:14.568473Z"}