ETK-2026-648Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-648",
  "cve_id": null,
  "display_id": "ETK-2026-648",
  "ghsa_id": "GHSA-v63m-pq3j-7m44",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Authorization bypass in Kora.js sync server",
  "summary": "Kora.js sync deployments using affected versions can allow clients to bypass server-side authentication, scope, or write-authorization checks. An attacker able to connect to a multi-user sync server may read or alter data belonging to other users or tenants; deployments without configured sync are not affected by these server issues.",
  "mitigation": "Upgrade korajs and every deployed @korajs/* package to 1.0.0-beta.13, updating sync servers before clients. Until upgraded, prevent untrusted clients from reaching sync servers and isolate tenants on separate sync servers where possible.",
  "vendor": "npm",
  "product": "npm:@korajs/server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.0.0-beta.12"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.0.0-beta.13"
      ],
      "package_name": "@korajs/server",
      "purl": "pkg:npm/@korajs/server"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.0.0-beta.12"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.0.0-beta.13"
      ],
      "package_name": "@korajs/auth",
      "purl": "pkg:npm/@korajs/auth"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.0.0-beta.12"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.0.0-beta.13"
      ],
      "package_name": "@korajs/sync",
      "purl": "pkg:npm/@korajs/sync"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.0.0-beta.12"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.0.0-beta.13"
      ],
      "package_name": "@korajs/store",
      "purl": "pkg:npm/@korajs/store"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.0.0-beta.12"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.0.0-beta.13"
      ],
      "package_name": "korajs",
      "purl": "pkg:npm/korajs"
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 110.20561865,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-05T10:42:40+00:00",
      "days": -15.755647069560185,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:50:47.930073+00:00",
      "url": "https://github.com/ehoneahobed/kora/security/advisories/GHSA-v63m-pq3j-7m44"
    }
  }
}