Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

Obot may restore removed group access for up to 10 minutes

CVE-2026-105140 · published 11 days ago
Summary

The Obot platform can mistakenly keep a user in a group they were removed from, lasting about ten minutes. This happens when the system updates group information at the same time and processes the changes out of order. Apply the latest updates for the affected versions to stop the issue.

What to do
  • Update obot-platform obot to version 0.25.6 or later.
Affected software
VendorProductAffected versions
obot-platform obot < 0.25.6
Original advisory text
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-362Race Condition
Timeline
Published7 Oct 2026
Updated14 Oct 2026
First seen7 Oct 2026
Sources
CVE-2026-105140 · NVD
CVE-2026-105140 · MITRE
CVE-2026-105140 · OSV
GHSA-929v-v9hq-5xhr · GHSA
Track software like this
Free during beta