convoy vulnerabilities

1 known vulnerability in convoy from Frain-dev. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  convoy: Authorization Bypass Through User-Controlled Key

  CVE-2026-81505Sep 18, 2026Frain-dev

  Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source o