An insecure direct object reference vulnerability in Julep allows authenticated tenants to access sensitive data belonging to other tenants, representing a high risk of cross-tenant data exposure.

This is an authorization bypass vulnerability (CWE-639) occurring in the get_execution_details endpoint. It allows an authenticated user to access execution data they are not authorized to view by manipulating the object reference.

This flaw leads to a critical breakdown in multi-tenant isolation, allowing unauthorized access to private execution logs and data. Given the CVSS score of 8.1, the potential for data leakage between tenants could lead to severe compliance violations and reputational damage.

Immediate Action: Update the Julep deployment to the latest version that includes the patch for the get_execution_details endpoint.

Proactive Monitoring: Review access logs for the get_execution_details endpoint to identify any attempts to access execution IDs associated with other tenant accounts.

Compensating Controls: Implement an application-level access control check that validates the ownership of the requested execution ID against the authenticated session context.

Public Exploit Available: No (unknown)

All Julep users must verify their current build and update to the patched version immediately. Given the sensitivity of multi-tenant data, addressing this authorization bypass is essential for maintaining tenant privacy and data security.