SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with view…

SuperPlane versions before 0.27.0 contain a broken object-level authorization (BOLA) vulnerability in the CanvasService gRPC handlers. Authenticated users with viewer-level access to one organization can access resources of other organizations by supplying arbitrary canvas or queue UUIDs without proper organization scoping. The vulnerability enables cross-tenant attacks including reading execution history and sensitive secrets, writing queue items and canvas events into victim organizations, and deleting arbitrary canvases. The flaw disrupts automation workflows across tenant boundaries, making it a significant multi-tenant isolation failure. The vulnerability was fixed in SuperPlane v0.27.0 via a commit that introduces proper organization-scoped authorization checks. References and patches are available via GitHub commits, pull requests, and the official release. The issue is also documented by VulnCheck in their advisories. Organizations using SuperPlane in multi-tenant environments should upgrade immediately to v0.27.0.