CVE-2026-50167: kurrier < 1.2.4

Affected technology

kurrier · < 1.2.4
kurrier-org

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.