CVE-2026-44678
Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID without verifying that the preview belongs to the project resolved from the URL path. The route's project-level authorization plug (AuthorizationPlug, :preview) authorizes the caller against the project encoded in account_handle/project_handle — which the attacker controls — and then the action deletes whichever preview's UUID is supplied. The check therefore guards the wrong project.
| CWE | CWE-639 |
| Vendor | tuist |
| Product | tuist |
| Published | May 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for tuist tuist
Be the first to know when new unknown vulnerabilities affecting tuist tuist are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
tuist / tuist
<= 1.180.8