CVE-2026-44678: Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-14 · updated 2026-06-17
Weakness: CWE-639

Description

Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID without verifying that the preview belongs to the project resolved from the URL path. The route's project-level authorization plug (AuthorizationPlug, :preview) authorizes the caller against the project encoded in account_handle/project_handle — which the attacker controls — and then the action deletes whichever preview's UUID is supplied. The check therefore guards the wrong project.

Affected products

tuist: through 1.180.8

References

https://github.com/tuist/tuist/security/advisories/GHSA-fqp5-hg46-cp2x

Get alerted when CVE-2026-44678 or the next vulnerability affects your stack