Fider: Cross-tenant authentication bypass via email verification key
Summary
In Fider's multi-tenant mode (HOST_MODE=multi), the lookup of email verification keys does not check the tenant. An attacker with any account on one tenant can use a sign-in verification key from that tenant to sign in as the same email address on another tenant. If that address is an administrator on the other tenant, the attacker gets full administrative access; otherwise a new account is created under that address. Single-host deployments (HOST_MODE=single, the default) are not affected.
Affected
- Fider versions before 0.36.0 running with HOST_MODE=multi
- Single-host deployments (HOST_MODE=single) are not affected
Fixed in
- Fider 0.36.0
Workaround
- Unknown. No vendor-documented workaround for multi-tenant mode was found. Upgrading is the fix.
Exploitation
- No evidence of exploitation in the wild was found.
- No public proof-of-concept was found in research. This does not prove that none exists.
- Not checked against the CISA KEV catalog.
Our recommendation
- Check whether any Fider instance runs with HOST_MODE=multi.
- Upgrade such instances to 0.36.0 or later, preferably the latest release.
- If a multi-tenant instance was exposed before the upgrade, review logs for unexpected sign-ins across tenants.
- Single-host installations need no action for this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-65840 www.cve.org
- GitHub Security Advisory GHSA-vxjw-gv4f-vq58 github.com
- Fider Release v0.36.0 github.com
- OffSeq Radar: CVE-2026-65840 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:20.
Original description (NVD)
Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.