CVE-2026-50875: Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2

Synopsis

This is an incorrect access control vulnerability (also called broken object-level authorization) in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1. It is reachable over the network and requires a low-privilege account, but no special permissions beyond that. A successful attacker can arbitrarily modify or delete webhook configurations belonging to other tenants in the same deployment. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the Deck9 Input service via HTTP/HTTPS.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account; no administrative or elevated role is needed beyond basic authentication.

• Victim interactionNot required

  No action from another user or tenant is required to complete the attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental factors beyond network access and a valid credential.

Blast Radius

• The attacker can modify webhook configurations belonging to any other tenant, redirecting form submission events to an attacker-controlled endpoint or altering integration behavior.
• The attacker can delete another tenant's webhooks entirely, silently breaking downstream integrations and event-driven workflows without the victim tenant receiving immediate notice.
• Persistent webhook tampering can cause ongoing data-routing failures or silent data loss for affected tenants until the configuration is manually audited and restored.