From 33feba2c9673383c3b0bd53906c89ac975feadd8 Mon Sep 17 00:00:00 2001
From: Pandey <vibhupandey28@gmail.com>
Date: Mon, 20 Jul 2026 02:27:17 +0530
Subject: [PATCH] Improve GHSA-3vgg-7h5g-62mm

---
 .../GHSA-3vgg-7h5g-62mm.json                  | 37 +++++++++++++++----
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/advisories/unreviewed/2026/06/GHSA-3vgg-7h5g-62mm/GHSA-3vgg-7h5g-62mm.json b/advisories/unreviewed/2026/06/GHSA-3vgg-7h5g-62mm/GHSA-3vgg-7h5g-62mm.json
index 3baa952e0b69d..09eb0d14ff5b4 100644
--- a/advisories/unreviewed/2026/06/GHSA-3vgg-7h5g-62mm/GHSA-3vgg-7h5g-62mm.json
+++ b/advisories/unreviewed/2026/06/GHSA-3vgg-7h5g-62mm/GHSA-3vgg-7h5g-62mm.json
@@ -1,23 +1,40 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3vgg-7h5g-62mm",
-  "modified": "2026-06-29T18:31:56Z",
+  "modified": "2026-06-29T18:32:02Z",
   "published": "2026-06-29T18:31:56Z",
   "aliases": [
     "CVE-2026-57956"
   ],
-  "details": "SigNoz through 0.130.1 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.",
+  "summary": "record update: patched in SigNoz v0.133.0",
+  "details": "SigNoz < v0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.",
   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L"
-    },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/SigNoz/signoz"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.133.0"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -27,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/SigNoz/signoz/issues/11830"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/SigNoz/signoz"
+    },
     {
       "type": "WEB",
       "url": "https://www.vulncheck.com/advisories/signoz-cross-organization-insecure-direct-object-reference-in-alert-rules"