CVE ID :CVE-2026-44678 Published : May 14, 2026, 9:16 p.m. | 1 hour, 20 minutes ago Description :Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID without verifying that the preview belongs to the project resolved from the URL path. The route's project-level authorization plug (AuthorizationPlug, :preview) authorizes the caller against the project encoded in account_handle/project_handle — which the attacker controls — and then the action deletes whichever preview's UUID is supplied. The check therefore guards the wrong project. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...