{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/identrail/identrail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59185"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T23:52:14Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nidentrail\u0027s GitHub App connection-completion endpoint binds a fully client-supplied `installation_id` to the caller\u0027s workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation access token for the supplied `installation_id` using the app\u0027s own JWT, so an authenticated tenant can link any other identrail customer\u0027s GitHub App installation into their own workspace and read that victim organization\u0027s private repositories.\n\n## Affected code (default-on path, no feature flag)\n\n- Route: `internal/api/router.go:3590` \u2014 `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete`. `installation_id` is read from the JSON body or the attacker-controlled `X-GitHub-Installation-ID` header (`router.go:3582-3588`).\n- Service: `internal/api/github_connect.go:781` `CompleteGitHubConnection`. The `state` token IS rigorously bound to the caller\u0027s scope (`github_connect.go:818`: `if stateRecord.TenantID != scope.TenantID || stateRecord.WorkspaceID != project.WorkspaceID || stateRecord.ProjectID != project.ProjectID { ... }`), but the only check on `installation_id` is `request.InstallationID \u003c= 0` (`:794`). The raw client value is persisted as the workspace\u0027s connection (`:840`).\n- Cross-tenant read primitive: `internal/connectors/github/repositories.go:39` `ListInstallationRepositories` \u2192 `internal/connectors/github/app.go:170` mints a token via `POST /app/installations/{installationId}/access_tokens` signed with the App JWT, succeeding for any installation where identrail\u0027s app is installed.\n\nThe feature-flagged V2 path `CompleteGitHubConnector` (`github_connect.go:447`, default off) shares the gap and is additionally weaker (matches pending connector by `state` value alone with no caller-scope re-check); a single fix should cover both.\n\n## Intent proof\n\nThe code binds `state` to `{TenantID, WorkspaceID, ProjectID}` and re-verifies it at completion (`:818`), demonstrating it understands binding is required. The asymmetry \u2014 `state` bound, `installation_id` unbound \u2014 is the missed check.\n\n## Exploitation\n\n1. Attacker is any authenticated identrail tenant; they call `StartGitHubConnection` for their own workspace and receive a `state`.\n2. Attacker calls the completion route with `{state: \u003ctheir state\u003e, installation_id: V}` where V is a victim org\u0027s identrail GitHub App installation id (installation ids are not secret \u2014 they appear in post-install redirect URLs, webhook payloads, the org\u0027s GitHub App settings, and are enumerable integers).\n3. `CompleteGitHubConnection` accepts (state matches attacker scope), `ListInstallationRepositories(V)` mints a token for V and lists the victim org\u0027s private repos, and the connection is persisted under the attacker\u0027s workspace.\n4. Attacker now reads the victim org\u0027s private repository inventory and can drive posture scans/repo reads via their own workspace.\n\nImpact: cross-tenant disclosure of another customer organization\u0027s private GitHub repositories and metadata.\n\n## Remediation\n\nBind `installation_id` with the same rigor as `state`: capture it from GitHub\u0027s signed post-install redirect (`setup_url`/`callback_url`) and pin it to the pending state at start time, and/or after minting verify the installation\u0027s `account` matches the org the initiating workspace is authorized for.",
  "id": "GHSA-cp3j-m783-3ph5",
  "modified": "2026-09-09T23:52:14Z",
  "published": "2026-09-09T23:52:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/identrail/identrail"
    },
    {
      "type": "WEB",
      "url": "https://github.com/identrail/identrail/releases/tag/v1.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller\u0027s workspace without ownership verification"
}