TDSA-2026-002

Summary

An authorization issue (CWE-639) was identified in app-scoped checks used by ToDesktop cloud services. Firestore rules allowed an authenticated user to create an application document under their own account using an arbitrary application ID, and a Cloud Function treated that document's existence as sufficient authorization for app-scoped operations.

The issue was responsibly disclosed through our Vulnerability Disclosure Program and fixed shortly after verification.

Impact

• Severity: Medium
• Attack Vector: Network-based, requires a ToDesktop account
• Potential Impact: We found no path to view or modify customer user data, application data, certificates, secrets, or build records. The demonstrated impact was writing a non-referenced secret to production Key Vault under an app-derived name.

We did not find a path for this issue to view or modify another customer's user data, canonical application data, or build records. We also did not find a path to create or release builds under another customer's account. Build and release operations resolved under the attacker's user ID so were limited to the attacker's own resources. Production certificate names and standard UI-created secret references also use random suffixes, limiting blind overwrite or deletion of existing Key Vault objects without the exact object name.

Technical Details

A Cloud Function checked whether an application document existed at users/{authenticatedUid}/applications/{appId}. Because Firestore rules permitted users to create those documents with arbitrary IDs under their own account, an attacker could create a document using another application's public ID and pass the affected check.

The fix denied client-created top-level application documents.

Actions and Remediations

We took the following actions:

• Updated Firestore security rules to deny client-created top-level application documents.
• Reviewed app-scoped Cloud Functions that relied on Firestore document existence checks.

No customer action is required.

Timeline

All timestamps are in Coordinated Universal Time (UTC).

Date and Time	Event
May 14th, 2026 11:04am	Vulnerability reported by Vipul Sahu.
May 14th, 2026 11:59am	Report acknowledged by ToDesktop.
May 14th, 2026 12:24pm	Vulnerability reproduced by ToDesktop.
May 14th, 2026 12:39pm	Firestore rules fix deployed.
August 9th, 2026	Public disclosure.

References

• CWE-639: Authorization Bypass Through User-Controlled Key
• ToDesktop Vulnerability Disclosure Program