EUVD-2026-114079 reports broken authorization in Tamery before 0.99.0
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- wannabespace
- Product
- Tamery
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-114079 describes a broken authorization flaw in Tamery (formerly Conar) 0.32.0 before 0.99.0, scored 5.3/10 (CVSS v3.1). Per the listing, authenticated users can attach resources to other users' connections through the cloud sync API.
If you use wannabespace
Upgrade Tamery to version 0.99.0 or later
Review shared cloud sync connections for unexpected resources
Update Tamery to version 0.99.0 or later
Review the vendor's advisory EUVD-2026-114080 for details of affected chats
Check cloud sync logs for unexpected chat access
What the sources say 2
· Mastodon: “Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable.” Source
· Mastodon: “Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections.” Source