The flaw is a cross‑tenant insecure direct object reference that lets an authenticated user view, alter, delete, or run other users’ robots and OAuth tokens. An attacker can read plaintext Google and Airtable tokens, compromising the confidentiality of those services, and can modify or delete robots, affecting integrity and availability of the affected infrastructure.

The vulnerability exists in any release of Maxun before version 0.0.42. Users running 0.0.41, 0.0.40, or earlier are exposed. There is no reported difference in other products, only the Maxun service is mentioned.

The assessment gives a CVSS score of 8.7, indicating high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the lack of exploitation data does not reduce the risk. An attacker must be an authenticated user of the service and there is no requirement for elevated privileges. The missing ownership checks in the storage and webhook API handlers provide a straightforward attack path for anyone who has legitimate credentials.