Description

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-13T17:17:26.940Z",
  "pubdate": "2026-08-13T17:17:26.940Z",
  "executiveSummary": "An access control vulnerability exists involving Public-Only Personal Access Tokens and organization and permission endpoints. The vulnerability allows authenticated threat actors with restricted public-only tokens to bypass intended scope limitations and interact with sensitive organization and permission endpoints that should otherwise be inaccessible.\nThe primary impact of this security flaw includes unauthorized access to organizational resources and metadata, potentially leading to unauthorized information disclosure and privilege escalation vectors within affected systems.\nThe affected systems comprise application environments utilizing Public-Only Personal access tokens for API authentication and authorization management.\nThe risk implications involve a compromise of the principle of least privilege, allowing limited-scope credentials to perform actions reserved for higher-privileged access tokens.\nAttacker capabilities are enhanced by this flaw, enabling them to leverage low-privilege public tokens to query or manipulate restricted organization configurations.\nExploitation requirements include possessing or generating a valid Public-Only Personal access token and sending crafted API requests targeting the vulnerable organization and permission endpoints.",
  "technicalDetails": "The root cause of the vulnerability stems from improper authorization checks and scope validation within organization and permission endpoints when processing incoming requests authenticated via Public-Only Personal access tokens.\nThe vulnerable component consists of the API routing and middleware layers responsible for enforcing token scope restrictions against requested organizational resources.\nAuthentication requirements involve the presentation of a valid Public-Only Personal access token during the API request lifecycle.\nPrivilege requirements are theoretically restricted to public-only scopes; however, the lack of robust server-side validation allows these low-privilege tokens to successfully interface with endpoints requiring elevated organizational permissions.\nNetwork exposure is inherent to any externally accessible API endpoints that handle organization management and permission queries.\nThe attack flow begins when an authenticated entity submits an API request to a targeted organization or permission endpoint using a restricted Public-Only Personal access token.\nInstead of rejecting the request due to insufficient scope privileges, the backend logic improperly evaluates the token permissions, bypasses the scope enforcement check, and processes the request.\nPost-exploitation impact permits the retrieval of sensitive organization data and permission structures, undermining the access control boundary established by token scopes."
}