N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9237-rg5p-rhfw

GHSA-9237-rg5p-rhfw: @saltcorn/data: Tenant user role is used for tenant creation role check

Summary

When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can simply append /tenant/create to their tenant URL. The system reads the role from the tenant context (admin), and a new tenant is created on the root domain (in PUBLIC SCHEMA > _sc_tenants), rather than in the tenant's own _sc_tenants table.

If the same logic applies to other routes, a tenant admin effectively gains admin rights on the root domain.

PoC

A tenant-created subtenant appears under the Saltcorn public schema instead of the tenant's own schema.

Even when role_id=1 is required for tenant creation on saltcorn.com (only admin can create tenants), existing tenant admins can still create new tenants because their local role_id:1 is evaluated against the root domain.
Even when role_to_create_tenant is set to 0 in the tenant's _sc_config schema, or removed entirely, the tenant admin can still create sub-tenants on the root domain — suggesting role_to_create_tenant is not being read at all.

Impact

Tenant admins gain unauthorized admin-level access to the root domain. Any authenticated tenant admin can perform privileged operations (e.g., creating tenants) on the root domain by exploiting the role context mismatch.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9237-rg5p-rhfw

GHSA-9237-rg5p-rhfw:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@saltcorn/data	npm	< 1.4.4	1.4.4
@saltcorn/data	npm	>= 1.5.0-beta.0, < 1.5.2	1.5.2
@saltcorn/data	npm	>= 1.6.0-alpha.0, < 1.6.0-beta.2	1.6.0-beta.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a tenant administrator to create new tenants on the root domain, effectively escalating their privileges to that of a root administrator. This is caused by an improper authorization check in the create_tenant_allowed function within packages/server/routes/tenant.js. This function is called by the route handlers for /tenant/create.

The vulnerability lies in the fact that the role check was performed against the tenant's context, while the action (tenant creation) was performed on the root context. An administrator of a tenant has role_id = 1 within their tenant. The vulnerable code checked this role and allowed the creation of a new tenant, but it failed to ensure that this action was authorized at the root level. The new tenant was then created in the public schema of the root application, not within the tenant's own schema.

The patch for this vulnerability introduces a check to determine if the current database schema is the default (root) schema. The authorization logic is then updated to only allow tenant creation if the request is coming from the root context or if the required role is set to a public-like level (100). By analyzing the patch that fixes the vulnerability, I was able to pinpoint the exact function that contained the flawed logic.

Vulnerable functions

create_tenant_allowed

packages/server/routes/tenant.js

The `create_tenant_allowed` function is vulnerable to an authorization bypass. It checks if a user has the required role to create a new tenant, but it does not properly distinguish between a tenant's context and the root application's context. When a tenant admin makes a request to create a tenant, the function evaluates the admin's role within their own tenant space. However, the tenant creation happens on the root domain. This allows a tenant admin to create tenants on the root domain, which should only be allowed for root admins. The patch fixes this by adding a check `isRoot` to ensure that the check is being performed in the root context.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.