CVE-2026-105140
LOW
2,3
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
4,2
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.
362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
DraftCommon Consequences
Security Scopes Affected:
Availability
Confidentiality
Integrity
Access Control
Potential Impacts:
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Dos: Crash, Exit, Or Restart
Dos: Instability
Read Files Or Directories
Read Application Data
Execute Unauthorized Code Or Commands
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Applicable Platforms
Languages:
C, C++, Java
Technologies:
Mobile, ICS/OT
https://github.com/obot-platform/obot
https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47…
https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47…
https://github.com/obot-platform/obot/blob/6f81dac8d344cf6b2161f500460fb7b2a975…
https://github.com/obot-platform/obot/commit/09e4d5b5d1e4a5f35a6cbcff96f3c460c3…
https://github.com/obot-platform/obot/commit/6f81dac8d344cf6b2161f500460fb7b2a9…
https://github.com/obot-platform/obot/releases/tag/v0.26.1
https://github.com/obot-platform/obot/security/advisories/GHSA-929v-v9hq-5xhr
https://www.vulncheck.com/advisories/obot-0.25.0-before-0.25.6-and-0.26.0-befor…