x/vulndb: potential Go vuln in github.com/identrail/identrail: GHSA-cp3j-m783-3ph5

[GoVulnBot]

Advisory GHSA-cp3j-m783-3ph5 references a vulnerability in the following Go modules:

Module
github.com/identrail/identrail

Description:

Summary

identrail's GitHub App connection-completion endpoint binds a fully client-supplied installation_id to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation access token for the supplied installation_id using the app's own JWT, so an authenticated tenant can link any other identrail customer's GitHub App installation into their own workspace and read that victim organization's private repositories.

Affected code (default-on path, no feature...

References:

• ADVISORY: GHSA-cp3j-m783-3ph5
• ADVISORY: GHSA-cp3j-m783-3ph5
• FIX: identrail/identrail@835e405
• WEB: https://github.com/identrail/identrail/releases/tag/v1.0.2

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/identrail/identrail
      versions:
        - fixed: 1.0.2
      vulnerable_at: 1.0.1
summary: |-
    Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound
    to the caller's workspace without ownership verification in github.com/identrail/identrail
cves:
    - CVE-2026-59185
ghsas:
    - GHSA-cp3j-m783-3ph5
references:
    - advisory: https://github.com/advisories/GHSA-cp3j-m783-3ph5
    - advisory: https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5
    - fix: https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7
    - web: https://github.com/identrail/identrail/releases/tag/v1.0.2
source:
    id: GHSA-cp3j-m783-3ph5
    created: 2026-09-10T00:01:54.159536643Z
review_status: UNREVIEWED