The vulnerability resides in the services/auth HTTP service of Taubyte Tau v1.1.10. A caller merely needs a valid GitHub OAuth token; the middleware only verifies the token and does not confirm that the token holder owns or has rights to the requested project. Consequently an attacker can read or permanently delete any project belonging to other tenants by sending GET or DELETE requests to /projects/{id}. This flaw permits cross‑tenant data compromise and deletion, essentially enabling an adversary to control another tenant’s project. The weakness corresponds to CWE‑639, Unauthorized Information Disclosure/Privilege Management. The attacker can execute destructive actions without needing administrative privileges on the target environment.

Taubyte tau (v1.1.10) running the services/auth HTTP endpoint. Any deployment of this version under a user that authenticates with a valid GitHub OAuth token is susceptible. The flaw appears in the authentication layer that is shared by all tenants.

The CVSS base score is 7.2, indicating a high severity impact and medium complexity of exploitation. The EPSS score is below 1%, suggesting a very low probability of current exploitation, and the flaw is not listed in CISA’s KEV catalog. Nevertheless, the issue can be leveraged by any authenticated user with a GitHub token, making it relatively easy to exploit once the attacker has a token. The direct attack path is a simple HTTP request to a known endpoint, and no additional privileges are required beyond token possession.