---
id: CVE-2026-119663
title: >-
  Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via
  connectionsResources.create
summary: >-
  Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization
  vulnerability in the cloud sync API connectionsResources.create handler that
  allows authenticated users to attach resources to other users' connections.
  Attacke…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: wannabespace
product: tamery
affected:
  - tamery >= 0.32.0 < 0.99.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T22:35:42.840263Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:35:52.067Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119663'
references:
  - url: 'https://github.com/wannabespace/tamery/issues/601'
  - url: >-
      https://github.com/wannabespace/tamery/commit/400a9001a661e5ab2f87c51de25da1c4afa7ceed
  - url: >-
      https://github.com/wannabespace/tamery/blob/v0.32.0/apps/api/orpc/routers/connections-resources/create.ts#L14-L32
  - url: 'https://hackmd.io/@hieuPenguinnn/conar-broken-ownership-cross-user-write'
  - url: 'https://github.com/wannabespace/tamery'
  - url: >-
      https://www.vulncheck.com/advisories/tamery-conar-0.32.0-before-0.99.0-broken-authorization-via-connectionsresources-create
    label: >-
      VulnCheck Advisory: Tamery (Conar) 0.32.0 before 0.99.0 Broken
      Authorization via connectionsResources.create
tags:
  - cve.org
epss: 0.00271
epssPercentile: 0.19443
ingestedAt: '2026-11-05T21:36:00.652Z'
---

## Overview

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.

## Affected

- `tamery >= 0.32.0 < 0.99.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.