CVE-2026-72741 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-72741HIGH

goodrain rainbond — Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   N    8.6   .0019    8.9     —

AFFECTED
  Product   Versions     Fixed
  rainbond  unspecified  —

TIMELINE
  Aug 10  Reserved by VulnCheck
  Aug 13  Published (CNA: VulnCheck)
  Aug 14  EXPLOIT PUBLISHED — CVE-2026-72741 (goodrain rainbond). Public exploit reference added.
  Aug 18  EXPLOIT PUBLISHED — CVE-2026-72741 (goodrain rainbond). Public exploit reference added.

CWE-639 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

Description

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
August 10, 2026	Reserved	Reserved by VulnCheck
August 13, 2026	Published	Published (CNA: VulnCheck)
August 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-72741 (goodrain rainbond). Public exploit reference added.
August 18, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-72741 (goodrain rainbond). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
goodrain	rainbond	—	—	—

Weaknesses

CWE-639

References (2)

Authoritative record: CVE-2026-72741 at cve.org

Vendors: goodrain

Weaknesses: CWE-639

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-72741 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.