GCVE - cpe:2.3:a:shuffle:shuffle:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:shuffle:shuffle:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-92716`	vulnerable	2026-10-13 12:28:53.508639	Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation CRITICAL (9.6) Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover across tenant boundaries. Published: 2026-09-16T17:31:37.053Z Updated: 2026-09-24T14:22:50.529Z Open on db.gcve.eu Reference links https://github.com/geo-chen/oss/blob/main/shuffle.md https://github.com/Shuffle/Shuffle https://github.com/Shuffle/shuffle-shared/blob/v1.2.50/shared.go#L9888-L9912 https://github.com/Shuffle/shuffle-shared/commit/c1b582e91b429bc7d5ad02e6c22f98234ec67615 https://www.vulncheck.com/advisories/shuffle-through-2.2.1-api-key-reset-cross-tenant-privilege-escalation	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.