https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T09:33:11.207190+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-44678 CVE-2026-44678 — Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID 2026-10-12T09:33:11.221465+00:00

Affected: tuist

Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID without verifying that the preview belongs to the project resolved from the URL path. The route's project-level authorization plug (AuthorizationPlug, :preview) authorizes the caller against the project encoded in account_handle/project_handle — which the attacker controls — and then the action deletes whichever preview's UUID is supplied. The check therefore guards the wrong project.