Swetrix Cloud: Missing authorization in project organisation assignment
Summary
Swetrix Cloud before version 5.1.0 does not check project ownership when a project is added to an organisation. An authenticated user can move another customer's project into their own organisation by its public tracking ID. From there the attacker can read analytics, change project settings or delete the project.
Affected
- Swetrix Cloud versions before 5.1.0 (CVE record: 0 to before 5.1.0)
- Self-hosted Community Edition: Unknown.
Fixed in
- Fixed in Swetrix Cloud 5.1.0 (commit 63eb76edcb446402ad1db5ff870920773f5ff588)
Workaround
- For Swetrix Cloud customers: Unknown. The vendor applies the fix.
- For self-hosted instances: Unknown. No workaround documented.
Exploitation
- No known exploitation in the wild (KEV: no).
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Swetrix Cloud customers: confirm with the vendor that the cloud service is patched, and check the account for unexpected project or organisation changes.
- Self-hosted operators: upgrade to 5.1.0 or later and review which users hold accounts on the instance.
- Limit account registration to trusted users where possible.
- Monitor project and organisation changes in the audit logs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linked commit: verify project ownership on org endpoints github.com
- Swetrix release v5.1.0 github.com
- VulnCheck advisory www.vulncheck.com
- CVE record (cvelistV5) raw.githubusercontent.com
- OSV entry osv.dev
- Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:03.
Original description (NVD)
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
NVD references (5)
- https://github.com/Swetrix/swetrix/blob/v5.0.3/backend/apps/cloud/src/project/project.controller.ts#L888-L920
- https://github.com/Swetrix/swetrix/commit/63eb76edcb446402ad1db5ff870920773f5ff588
- https://github.com/Swetrix/swetrix/issues/477
- https://github.com/Swetrix/swetrix/releases/tag/v5.1.0
- https://www.vulncheck.com/advisories/swetrix-cloud-before-5.1.0-missing-authorization-via-post-project-organi…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.