ETK-2026-940Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-940",
  "cve_id": null,
  "display_id": "ETK-2026-940",
  "ghsa_id": "GHSA-mvqj-v4m3-889g",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Improper authorization in eneo integration preview service",
  "summary": "The integration preview service in eneo 2.1.1 can retrieve preview data for an integration without confirming that the requester owns it or belongs to its tenant. An authenticated user who can supply another integration's identifier may access content from that user's connected storage through the stored OAuth authorization.",
  "mitigation": "Upgrade eneo to version 2.2.0. Until the upgrade is complete, disable or tightly restrict integration preview access and enforce ownership and tenant checks before loading integrations or using their OAuth tokens.",
  "vendor": "other",
  "product": "other:eneo",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 2.2.0-rc.5"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "2.2.0"
      ],
      "package_name": "eneo",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 38.51352228333333,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-08T06:01:44.896451+00:00",
      "days": -12.990096387962963,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:47:29.246525+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T07:42:36+00:00",
      "days": -13.920060467256944,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:47:29.246525+00:00",
      "url": "https://github.com/eneo-ai/eneo/security/advisories/GHSA-mvqj-v4m3-889g"
    }
  }
}