CVE-2026-92716

Shuffle through version 2.2.1 contains a cross-tenant privilege escalation flaw (CWE-639, authorization bypass via user-controlled key) in its HandleApiGeneration endpoint. An attacker who holds administrator privileges in one organization can supply arbitrary user IDs belonging to non-administrator users in different organizations; the endpoint fails to verify that the targeted user belongs to the caller's tenant and generates valid API keys for those accounts. This effectively lets a tenant admin reset and read other users' API keys, enabling account takeover across tenant boundaries on a shared instance. Any Shuffle deployment at version 2.2.1 or earlier that hosts multiple organizations is affected; exploitation requires network access to the instance and an organization-admin account. No exploitation has been reported: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade Shuffle to the newest available release and monitor the vendor for a patched version above 2.2.1, since all versions through 2.2.1 are vulnerable. In the interim, keep Shuffle instances off the public internet, minimize the number of organization-admin accounts, and review logs of the HandleApiGeneration endpoint for API-key generation requests referencing user IDs outside the admin's own organization.