Description

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.

Related CPE's

Could not find any relations

References

https://github.com/obot-platform/obot

https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/group.go#L652-L734

https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/identity.go#L444-L456

https://github.com/obot-platform/obot/blob/6f81dac8d344cf6b2161f500460fb7b2a975c415/pkg/gateway/client/group.go#L741-L757

https://github.com/obot-platform/obot/commit/09e4d5b5d1e4a5f35a6cbcff96f3c460c3f9e278

https://github.com/obot-platform/obot/commit/6f81dac8d344cf6b2161f500460fb7b2a975c415

https://github.com/obot-platform/obot/releases/tag/v0.26.1

https://github.com/obot-platform/obot/security/advisories/GHSA-929v-v9hq-5xhr

https://www.vulncheck.com/advisories/obot-0.25.0-before-0.25.6-and-0.26.0-before-0.26.1-race-condition-restores-revoked-group-membership

Weaknesses

[email protected]

Secondary
CWE-362

CVSS impact metrics

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.2 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-07T13:17:19.590Z

43 hours ago

Last modified

2026-10-07T21:17:10.090Z

35 hours ago