Missing Authorization in migration-planner Allows Authenticated User to Delete All Customer Data (CVE-2026-53469)
critical-cve-against-dependency · active
A broken authorization flaw in migration-planner lets any authenticated user delete all customer data by sending a DELETE request to the /api/v1/sources endpoint. Because the route lacks proper authorization and filtering, exploitation can wipe sources, agents, and assessments across the entire SaaS platform.