CVE-2026-92716CWE-639

CVE-2026-92716

Critical · published September 16, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover across tenant boundaries.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00426 · 35.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-16T22:17Z
References (6)
https://github.com/geo-chen/oss/blob/main/shuffle.md · [email protected]https://www.vulncheck.com/advisories/shuffle-through-2.2.1-api-key-reset-cross-tenant-privilege-escalation · [email protected]https://github.com/geo-chen/oss/blob/main/shuffle.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/Shuffle/Shuffle · [email protected]https://github.com/Shuffle/shuffle-shared/blob/v1.2.50/shared.go#L9888-L9912 · [email protected]https://github.com/Shuffle/shuffle-shared/commit/c1b582e91b429bc7d5ad02e6c22f98234ec67615 · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 17:31Z
    Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation
    cvelistv5