Security Advisory

CVE-2026-44678

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-14 20:41:40

Last updated 2026-05-16 01:03:16

Assigner GitHub_M

CVSS score 7.1

State PUBLISHED

Description

Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID without verifying that the preview belongs to the project resolved from the URL path. The route's project-level authorization plug (AuthorizationPlug, :preview) authorizes the caller against the project encoded in account_handle/project_handle — which the attacker controls — and then the action deletes whichever preview's UUID is supplied. The check therefore guards the wrong project.

← Browse all CVEs View on cve.org ↗