CVE-2026-44678: Tuist

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID without verifying that the preview belongs to the project resolved from the URL path. The route's project-level authorization plug (AuthorizationPlug, :preview) authorizes the caller against the project encoded in account_handle/project_handle — which the attacker controls — and then the action deletes whichever preview's UUID is supplied. The check therefore guards the wrong project.

Affected products

• Tuist Tuist: up to and including 1.180.8

Published 2026-05-14. Last modified 2026-06-17.