CVE-2026-89112

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89112
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89112.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-89112
Aliases
  • GHSA-8rcv-xqgf-8743
Published
2026-10-13T00:26:06Z
Modified
2026-10-15T02:30:41Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure
Details

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.

Database specific 
{
    "cna_assigner":  "sap",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89112.json"
}
References

Affected packages

Git / github.com/cla-assistant/cla-assistant

Affected ranges

Type
GIT
Repo
https://github.com/cla-assistant/cla-assistant
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
bca7573c14ba50a1073a684f3c5f4b28733a3c60
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "v2.13.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.10.0
v1.10.1
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.9.0
v1.9.1
v1.9.2
Other
v2
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.13.1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1
v2.6.2
v2.7.0
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.9.0
v2.9.1
v2.9.2
v2.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89112.json"