Medium 4.2Published Oct 7, 2026

CVE-2026-105140Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership

Updated under an hour ago (Oct 28, 2026, 6:00 AM ET)

Does this affect you?

It affects obot-platform obot. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for obot-platform obot

Exploited in the last 30 days

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.

CVSS: 4.2 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

obot-platform obot obot_platform:obot (from the name)	from 0.25.0 before 0.25.6; from 0.26.0 before 0.26.1	CNA record

References

References

https://github.com/obot-platform/obot/commit/6f81dac8d344cf6b2161f500460fb7b2a975c415	patch
https://github.com/obot-platform/obot	product
https://github.com/obot-platform/obot/security/advisories/GHSA-929v-v9hq-5xhr	vendor-advisory
https://github.com/obot-platform/obot/commit/09e4d5b5d1e4a5f35a6cbcff96f3c460c3f9e278	patch
https://github.com/obot-platform/obot/releases/tag/v0.26.1	release-notes
https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/group.go#L652-L734	technical-description
https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/identity.go#L444-L456	technical-description
https://github.com/obot-platform/obot/blob/6f81dac8d344cf6b2161f500460fb7b2a975c415/pkg/gateway/client/group.go#L741-L757	technical-description
https://www.vulncheck.com/advisories/obot-0.25.0-before-0.25.6-and-0.26.0-before-0.26.1-race-condition-restores-revoked-group-membership	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.