CVE-2026-112000

{
  "etk_id": "ETK-2026-2156",
  "cve_id": "CVE-2026-112000",
  "display_id": "CVE-2026-112000",
  "ghsa_id": "GHSA-93jv-pwc6-2cqf",
  "euvd_id": "EUVD-2026-103453",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing gateway authorization in Vanus",
  "summary": "Vanus gateway versions 0.8.0 through 0.9.0 fail to enforce authorization for certain subscription and unregistered method calls. An authenticated user may access another tenant's subscription data, acknowledge its events, disrupt its consumer, or enumerate users.",
  "mitigation": "Restrict gateway access to trusted, tenant-scoped accounts and revoke unnecessary credentials. Upgrade to a vendor release confirmed to be outside the affected range when one is available.",
  "vendor": "vanus-labs",
  "product": "vanus",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.8.0, <= 0.9.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "vanus",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
  "epss_score": 0.0029,
  "epss_percentile": 0.2018,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.5625712,
  "t0_at": "2026-10-18T11:38:25.755000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-18T11:38:25.755000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T11:38:25.755000+00:00",
      "url": "https://github.com/advisories/GHSA-93jv-pwc6-2cqf"
    }
  }
}