—

GO-2026-6448

Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail

Quick fix

GO-2026-6448 — github.com/identrail/identrail: upgrade to the fixed version with the command below.

go get github.com/identrail/identrail@v1.0.2

Details

Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/identrail/identrail

Introduced in: 0Fixed in: 1.0.2

Fixgo get github.com/identrail/identrail@v1.0.2

References

https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5[ADVISORY]
https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7[FIX]
https://github.com/identrail/identrail/releases/tag/v1.0.2[WEB]