Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-72741 Broken Access Control in Rainbond 6.9.7 Allows Unauthorized Resource Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-72741
Post summary
The entry announces a new vulnerability in Rainbond 6.9.7, describing it as a broken access control issue that permits unauthorized resource access, without providing PoC, exploit details, or mitigation information.