CVE-2026-57956

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-57956

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57956.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-57956

Published

2026-06-29T17:22:45.706Z

Modified

2026-07-21T03:47:27.412388401Z

Severity

6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules

Details

SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57956.json",
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "0.133.0"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "0.133.0"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-639"
    ]
}

References

Affected packages

Git / github.com/signoz/signoz

Affected ranges

Type

GIT

Repo

https://github.com/signoz/signoz

Events

Introduced

Fixed

bc8c36095caf28dcc908787971a5bd4e6c5d0118

Database specific

{
    "source": "DESCRIPTION",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.130.1"
        }
    ]
}

Affected versions

0.*

0.1.0

0.2.0

0.2.2

0.3.5

histogram-quantile/v0.*

histogram-quantile/v0.0.1

v0.*

v0.100.0

v0.100.1

v0.101.0

v0.101.0-rc.1

v0.102.0

v0.102.1

v0.103.0

v0.103.1

v0.104.0

v0.104.0-cloud.1

v0.105.0

v0.105.1

v0.106.0

v0.107.0

v0.108.0

v0.108.0-rc.1

v0.109.0

v0.109.1

v0.109.2

v0.109.3

v0.110.0

v0.110.1

v0.111.0

v0.112.0

v0.112.1

v0.113.0

v0.113.0-rc.1

v0.114.0

v0.114.1

v0.115.0

v0.116.0

v0.116.1

v0.117.0

v0.117.1

v0.118.0

v0.119.0

v0.120.0

v0.121.0

v0.121.1

v0.122.0

v0.123.0

v0.124.0

v0.125.0

v0.125.1

v0.126.0

v0.126.1

v0.126.3-rc.1

v0.127.0

v0.127.1

v0.128.0

v0.129.0

v0.130.0

v0.2.2

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.3.6

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.55.0

v0.64.0

v0.65.0

v0.65.0-cloud.2

v0.65.0-cloud.3

v0.65.0-cloud.4

v0.65.0-cloud.5

v0.65.0-cloud.6

v0.65.0-cloud.7

v0.65.1

v0.66.0

v0.67.0

v0.67.0-custom-domain-15f85a645

v0.67.1

v0.68.0

v0.69.0

v0.69.0-cloud.1

v0.69.0-cloud.2

v0.70.0

v0.70.1

v0.71.0

v0.71.0-cloud.1

v0.71.0-cloud.2

v0.72.0

v0.72.0-aws-integration-c3164912e

v0.72.0-cloud.1

v0.72.0-cloud.2

v0.72.0-cloud.3

v0.72.0-cloud.4

v0.73.0

v0.73.0-407654e6

v0.73.0-cloud.1

v0.73.0-cloud.2

v0.73.0-cloud.3

v0.74.0

v0.74.0-cloud.1

v0.75.0

v0.75.0-cloud.1

v0.76.0

v0.76.0-cloud.1

v0.76.0-cloud.2

v0.76.0-cloud.3

v0.76.0-cloud.4

v0.76.1

v0.76.2

v0.76.2-ac7ecac2

v0.77.0

v0.77.0-cloud.1

v0.77.0-cloud.2

v0.78.0

v0.78.0-3142b6cc6

v0.78.0-cloud.1

v0.78.1

v0.79.0

v0.79.1

v0.80.0

v0.80.0-cloud.1

v0.81.0

v0.82.0

v0.82.0-cloud.1

v0.82.1

v0.83.0

v0.83.0-cloud.1

v0.84.0

v0.84.1

v0.85.0

v0.85.1

v0.85.2

v0.85.3

v0.86.0

v0.86.1

v0.86.2

v0.87.0

v0.87.0-rc.1

v0.88.0

v0.88.0-cloud.1

v0.88.0-cloud.2

v0.88.0-cloud.3

v0.88.0-rc.1

v0.88.1

v0.89.0

v0.89.0-cloud.1

v0.90.0

v0.90.1

v0.91.0

v0.91.1

v0.92.0

v0.92.0-cloud.1

v0.92.0-rc.1

v0.92.0-rc.5

v0.92.1

v0.92.2

v0.93.0

v0.93.0-cloud.1

v0.93.0-cloud.2

v0.93.0-cloud.3

v0.93.0-rc.1

v0.93.0-rc.2

v0.93.0-rc.3

v0.94.0

v0.94.1

v0.94.1-cloud.1

v0.95.0

v0.95.1

v0.95.1-cloud.1

v0.96.0

v0.96.1

v0.97.0

v0.97.0-rc.1

v0.97.0-rc.2

v0.97.0-rc.3

v0.97.1

v0.98.0

v0.98.0-rc.0

v0.98.0-rc.1

v0.99.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57956.json"