CVE-2026-119663

Medium

Description

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.

SeverityMedium

CVSS4.3

Exploit probability—

ProductWannabespace Tamery

PublishedOct 30, 2026

First seenNov 4, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

wannabespace tamery0.99.0 or later

Patches

github.com/wannabespace/tamery/commit/400a9001a661e5ab2f87c51de25da1c4afa7ceed

Affected products

Product	Affected versions	Fixed in
wannabespace tamery	0.32.0 ≤ v < 0.99.0	0.99.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.