Description

In HarnessRouter Community Edition from 0.4.2 until 0.31.7, routes that take a session or response id checked only the caller's organization and not the workspace an API key was made in, while the session list was filtered by that workspace (CWE-639). A key of a non-default workspace that learned the id of another workspace's session in the same organization could read its metadata, turns, trace and files, overwrite files, cancel or delete it, and publish a share link for it. Organization boundaries held. Fixed in 0.31.7 (PR #417).

CVSS Vector

Primary assessmentGitHub CNA · 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AV: NetworkAC: HighPR: LowUI: NoneS: UnchangedC: HighI: HighA: High

Disclosure Status

Affected
harnessrouter >= 0.4.2, < 0.31.7
Patch status
Fixed in 0.31.7
Vendor response
Maintainers merged PR #417, released 0.31.7 and published GHSA-9pjr-97x3-c4wv
Primary score source
GitHub CNA

References

Record Verification

CreditThe GitHub advisory GHSA-9pjr-97x3-c4wv credits Sevban DÖNMEZ (jankesec) as reporter
PublishedThe CVE record was published on 2026-11-10
CheckedMetadata last checked against the CVE Services record on 2026-11-10

Disclosure Timeline

2026-09-08Reported — Reported privately through GitHub private vulnerability reporting, with a reproducing test, as GHSA-9pjr-97x3-c4wv.
2026-10-06Fix released — PR #417 merged and HarnessRouter 0.31.7 released; GHSA-9pjr-97x3-c4wv published the same day. Source ↗
2026-11-10Published — GitHub, as CNA, published the CVE record. Source ↗
2026-11-10Site verification — jankesec re-ran the reproduction against 0.31.6 and 0.31.7 and checked the CVE record, score, affected versions and references.