Security advisory2026-10-15Software component projectSecurity advisory

Software component issue could allow unauthorized access

IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by…

What happened

  • IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.Security Advisory CVE-2026-76066
  • IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting,…Advisory description (CVE-2026-76066)

Contributing factors stated by the source

  • IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting,…

The failure pattern

Cross-tenant access through a caller-controlled identifierThe server trusts an account, tenant or object ID sent by the client, so changing a number reveals someone else's data.How to prevent it AI action exceeds its intended scopeAn AI agent or assistant takes an action, or makes a promise, that nobody meant it to be able to make.How to prevent it
Watch the pattern: Cross-tenant access through a caller-controlled identifier

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern

Security advisory2026-10-16

Software component issue could allow unauthorized access

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing…

Cross-tenant access through a caller-controlled identifiernvd.nist.gov
Security advisory2026-10-16

Software component issue could allow unauthorized access

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is…

Cross-tenant access through a caller-controlled identifiernvd.nist.gov