Fider Multi-Tenant Authentication Bypass Vulnerability

In Fider, a feedback portal for feature requests and suggestions, a tenant isolation bypass vulnerability has been discovered.

Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants.

• Affected versions: prior to 0.36.0
• Condition: multi-tenant mode (HOST_MODE=multi)
• Impact: tenant isolation bypass, account takeover
• Single-host deployments (HOST_MODE=single, the default) are NOT affected
• Patched in version 0.36.0