Fonoster versions up to 0.22.7 contain a flaw in the UpdateWorkspace handler that allows any authenticated user to rename a workspace. The handler erroneously continues after raising a PERMISSION_DENIED error, permitting the underlying database update to succeed. Consequently, the caller receives a permission error for a change that has already been applied, effectively granting unauthorized modification of workspace metadata. This flaw does not provide remote code execution but gives privilege escalation or denial of service to workspace owners.

The vulnerability affects the open‑source Fonoster platform, identified as fonoster:fonoster. All releases released through version 0.22.7 are impacted. Users running deployments that expose the Identity/UpdateWorkspace endpoint and rely on authentication are at risk.

The CVSS score of 5.3 indicates medium severity. While EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, the requirement for only authentication and the lack of complex prerequisites make exploitation straightforward for anyone who can access the API. Attackers do not need elevated privileges beyond a standard user token, and the misuse of the API can lead to unauthorized workspace renaming, potentially disrupting services or misrepresenting ownership.