—
GO-2026-5453
ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace in github.com/shellhub-io/shellhub
Quick fix
GO-2026-5453 — github.com/shellhub-io/shellhub: upgrade to the fixed version with the command below.
go get github.com/shellhub-io/shellhub@v0.24.2Details
ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace in github.com/shellhub-io/shellhub
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/shellhub-io/shellhub
Introduced in:
0Fixed in: 0.24.2Fix
go get github.com/shellhub-io/shellhub@v0.24.2