TI-2026-74570 CVE-2026-76066 · GHSA-6qqv-mhm9-qrfj
Authorization bypass in IntentKit lets callers run owner-only tools
Priority HIGH 77
IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisem…