Summary
SuperPlane prior to 0.27.0 contains a broken object-level authorization flaw in CanvasService gRPC handlers that lets authenticated users access resources outside their own organization by guessing or supplying arbitrary canvas or queue UUIDs.
When organization scoping is not enforced, a viewer in one tenant can read sensitive cross-tenant execution history and event payloads, as well as write and delete automation artifacts in other organizations' environments.
SuperPlane prior to 0.27.0 contains a broken object-level authorization flaw in CanvasService gRPC handlers that lets authenticated users access resources outside their own organization by guessing or supplying arbitrary canvas or queue UUIDs.
When organization scoping is not enforced, a viewer in one tenant can read sensitive cross-tenant execution history and event payloads, as well as write and delete automation artifacts in other organizations' environments.
Affected context
This vulnerability appears in SuperPlane deployments where:
- Multi-tenant organizations share a common CanvasService gRPC API surface
- Canvas and queue resources are referenced primarily via UUIDs
- Authorization checks validate user authentication and basic role (e.g., viewer) but do not consistently validate organization membership for targeted resources
- The server accepts identifiers for canvases, queues, and related entities without enforcing tenant boundaries
In such contexts, an authenticated user from one organization can interact with resources that logically belong to a different organization if they can supply those UUIDs to the CanvasService handlers.
This vulnerability appears in SuperPlane deployments where:
- Multi-tenant organizations share a common CanvasService gRPC API surface
- Canvas and queue resources are referenced primarily via UUIDs
- Authorization checks validate user authentication and basic role (e.g., viewer) but do not consistently validate organization membership for targeted resources
- The server accepts identifiers for canvases, queues, and related entities without enforcing tenant boundaries
In such contexts, an authenticated user from one organization can interact with resources that logically belong to a different organization if they can supply those UUIDs to the CanvasService handlers.
Exploit preconditions
- Attack surface: CanvasService gRPC endpoints that operate on canvases, queues, execution history, and automation events.
- Required access: Valid authenticated account in any SuperPlane organization, typically with viewer-level or similar access.
- Trigger point: Invocation of CanvasService gRPC methods using UUIDs (canvas IDs, queue IDs, event IDs) that belong to a different organization.
- Why exploitation is possible: The authorization logic fails to enforce object-level organization scoping, relying on global identifiers and role checks without verifying that the requested resource is owned by the caller's organization. As a result, cross-tenant resource access is permitted when arbitrary UUIDs are supplied.
- Attack surface: CanvasService gRPC endpoints that operate on canvases, queues, execution history, and automation events.
- Required access: Valid authenticated account in any SuperPlane organization, typically with viewer-level or similar access.
- Trigger point: Invocation of CanvasService gRPC methods using UUIDs (canvas IDs, queue IDs, event IDs) that belong to a different organization.
- Why exploitation is possible: The authorization logic fails to enforce object-level organization scoping, relying on global identifiers and role checks without verifying that the requested resource is owned by the caller's organization. As a result, cross-tenant resource access is permitted when arbitrary UUIDs are supplied.
Why this happens
This issue is rooted in broken object-level authorization, where access control is applied at the user or session level but not at the resource level. The CanvasService gRPC handlers trust UUIDs supplied by the client and authorize operations based on authentication and role, without verifying that the targeted canvas or queue belongs to the caller's organization.
Conceptually, this maps to CWE-639: Authorization Bypass Through User-Controlled Key, in which user-controlled identifiers (such as UUIDs) are treated as sufficient proof of access. Instead of binding each object operation to tenant membership or ownership checks, the implementation allows cross-tenant reads, writes, and deletions whenever a valid ID is present. This insecure pattern is common in multi-tenant systems that rely on global keys without enforcing per-tenant constraints.
This issue is rooted in broken object-level authorization, where access control is applied at the user or session level but not at the resource level. The CanvasService gRPC handlers trust UUIDs supplied by the client and authorize operations based on authentication and role, without verifying that the targeted canvas or queue belongs to the caller's organization.
Conceptually, this maps to CWE-639: Authorization Bypass Through User-Controlled Key, in which user-controlled identifiers (such as UUIDs) are treated as sufficient proof of access. Instead of binding each object operation to tenant membership or ownership checks, the implementation allows cross-tenant reads, writes, and deletions whenever a valid ID is present. This insecure pattern is common in multi-tenant systems that rely on global keys without enforcing per-tenant constraints.
Potential impact
- Authenticated users may read execution histories belonging to other organizations.
- Attackers could access event payloads containing secrets or sensitive configuration from victim tenants.
- Malicious users may inject queue items and canvas events into other organizations, influencing or poisoning their automation workflows.
- Adversaries can delete canvases owned by other tenants, disrupting business processes and automation pipelines.
- Cross-tenant data exposure can lead to regulatory compliance issues and privacy violations.
- Workflow tampering could enable indirect compromise of integrated systems or services.
- Authenticated users may read execution histories belonging to other organizations.
- Attackers could access event payloads containing secrets or sensitive configuration from victim tenants.
- Malicious users may inject queue items and canvas events into other organizations, influencing or poisoning their automation workflows.
- Adversaries can delete canvases owned by other tenants, disrupting business processes and automation pipelines.
- Cross-tenant data exposure can lead to regulatory compliance issues and privacy violations.
- Workflow tampering could enable indirect compromise of integrated systems or services.
General mitigation guidance
Mitigation focuses on enforcing strict object-level authorization across all multi-tenant resource operations. Common defensive patterns include:
- Binding every canvas, queue, and related resource to an explicit organization or tenant identifier and enforcing checks on each gRPC handler before performing actions.
- Implementing centralized authorization middleware or service that validates resource ownership and tenant scoping rather than duplicating checks ad hoc.
- Designing APIs so that resource identifiers are always resolved through organization-scoped queries rather than accepting raw global UUIDs from clients.
- Reducing trust in client-supplied IDs by deriving accessible resource lists from the server side and validating that requested objects appear within those sets.
- Applying least-privilege role design, ensuring viewer-level permissions cannot perform destructive actions even within their own organization.
- Incorporating secure-by-default multi-tenant patterns, such as partitioned data stores and per-tenant access boundaries, to make cross-tenant access structurally difficult.
Mitigation focuses on enforcing strict object-level authorization across all multi-tenant resource operations. Common defensive patterns include:
- Binding every canvas, queue, and related resource to an explicit organization or tenant identifier and enforcing checks on each gRPC handler before performing actions.
- Implementing centralized authorization middleware or service that validates resource ownership and tenant scoping rather than duplicating checks ad hoc.
- Designing APIs so that resource identifiers are always resolved through organization-scoped queries rather than accepting raw global UUIDs from clients.
- Reducing trust in client-supplied IDs by deriving accessible resource lists from the server side and validating that requested objects appear within those sets.
- Applying least-privilege role design, ensuring viewer-level permissions cannot perform destructive actions even within their own organization.
- Incorporating secure-by-default multi-tenant patterns, such as partitioned data stores and per-tenant access boundaries, to make cross-tenant access structurally difficult.
How teams detect issues like this
Effective detection strategies combine code-level analysis with behavioral monitoring:
- Use static analysis and code review to identify gRPC handlers or controller methods that accept user-controlled IDs (UUIDs, keys) without accompanying tenant or ownership checks.
- Look for authorization logic that validates only authentication or role, but omits resource-level scoping, especially in multi-tenant components like CanvasService.
- Establish security review policies requiring explicit mention of tenant boundaries and ownership checks for any API that references cross-tenant resources.
- Monitor logs for patterns where a single authenticated identity interacts with resources mapped to multiple organizations or tenant identifiers.
- Employ automated code review tools and linters configured with rules targeting CWE-639-style issues, flagging uses of raw identifiers in authorization-critical paths.
Effective detection strategies combine code-level analysis with behavioral monitoring:
- Use static analysis and code review to identify gRPC handlers or controller methods that accept user-controlled IDs (UUIDs, keys) without accompanying tenant or ownership checks.
- Look for authorization logic that validates only authentication or role, but omits resource-level scoping, especially in multi-tenant components like CanvasService.
- Establish security review policies requiring explicit mention of tenant boundaries and ownership checks for any API that references cross-tenant resources.
- Monitor logs for patterns where a single authenticated identity interacts with resources mapped to multiple organizations or tenant identifiers.
- Employ automated code review tools and linters configured with rules targeting CWE-639-style issues, flagging uses of raw identifiers in authorization-critical paths.
