CVE-2026-119663 Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

Medium 5.3 Published 30 Oct 2026 Updated 4 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119663?

CVE-2026-119663 is a medium-severity vulnerability in wannabespace tamery, published on 30 Oct 2026.

Official description

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.

Weakness: CWE-639

Which versions are affected by CVE-2026-119663?

How do I fix CVE-2026-119663?

No fix has been published for CVE-2026-119663 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119663 being exploited?

There is no known exploitation of CVE-2026-119663 in the wild and no public exploit code.

Sources

Also known as GHSA-mf38-vc74-jfg4.