CVE-2026-81505

frain-dev/convoy (all versions up to and including v26.6.2, no patch
available) lets any authenticated caller who is authorized on at least one
project read ANY OTHER project's "Source" record by ID via
GET /api/v1/projects/{projectID}/sources/{sourceID} -- regardless of whether
that Source actually belongs to the project named in the URL. The response
includes the Source's full PubSub broker configuration in plaintext
(AMQP/Kafka/SQS/Google credentials), with no redaction.

Details

Handler.GetSource (api/handlers/source.go) resolves the caller's
authorization against the {projectID} in the URL via retrieveProject(), then
calls sources.Service.FindSourceByID(ctx, project.UID, sourceID)
(internal/sources/impl.go). That function accepts a projectID parameter but
never uses it:

func (s *Service) FindSourceByID(ctx context.Context, projectID, id string) (*datastore.Source, error) {
    row, err := s.repo.FetchSourceByID(ctx, common.StringToPgText(id))
    ...
}

The underlying SQL query (internal/sources/repo/queries.sql,
fetchSourceByID) has no project_id predicate at all:

SELECT ... FROM convoy.sources AS s
LEFT JOIN convoy.source_verifiers sv ON s.source_verifier_id = sv.id
WHERE s.id = $1 AND s.deleted_at IS NULL

So the {projectID} in the URL only gates "is the caller authorized to view
a project" -- it never re-validates that the fetched Source actually
belongs to that project. LoadSourcesPaged (the list endpoint) does
correctly scope by project; only the single-item GetSource lookup is
affected. SourceResponse{*datastore.Source} embeds the full database
record with no redaction, so if the leaked Source is an AMQP/Kafka type, its
pub_sub.*.auth.password field (a live, plaintext broker credential) is
returned verbatim.

Proof of Concept

1. As a test account, create "Victim Project" and an AMQP Source in it
   with a known broker password (verified against a real RabbitMQ broker,
   not just stored -- Convoy performs a live connectivity check before
   persisting an AMQP source).
2. As the same or a different authenticated caller, create a completely
   separate "Attacker Project".
3. Call GET /api/v1/projects/{attacker_project_id}/sources/{victim_source_id}
   -- i.e. a request whose URL and authorization check only ever resolve
   the Attacker project.
4. Verified in a Docker lab (convoy v26.6.2): the request returns 200 with
   the Victim project's full Source object, including
   pub_sub.amqp.auth.password matching the secret set in step 1 exactly.
   The response's own project_id field is the Victim project's id, never
   the Attacker project id used in the URL/authorization check.
5. Negative control: an otherwise-identical request for a made-up source id
   under the same Attacker project returns 404, confirming this is a real,
   ID-specific hit and not a blanket-200 endpoint.

(Community Edition license-gates org_limit=1/user_limit=1, so this PoC used
one account with two projects rather than two separate companies -- the
vulnerable query performs no project-ownership check regardless of license
tier, so a licensed multi-org deployment has the identical exposure between
genuinely different tenants.)

Affected / Patched

Affected: <= v26.6.2 (latest release at time of report). No patched version
available.