{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2024-010",
  "link": "https://tailscale.com/security-bulletins/#ts-2024-010",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2024-010",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Fri, 19 Jul 2024 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Accidental ACL edits due to browser caching\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eWhen switching tailnets in the admin console, an \u003ca href=\"https://tailscale.com/kb/1138/user-roles#admin\"\u003eAdmin\u003c/a\u003e user\ncould overwrite the \u003ca href=\"https://tailscale.com/kb/1018/acls\"\u003eACLs\u003c/a\u003e of one tailnet with pending changes to ACLs\nfrom another tailnet.\u003c/p\u003e\n\u003cp\u003eWhen a user has unsaved ACL changes in the admin console, those changes are\ncached in browser storage. If this user is a member of multiple tailnets,\ntailnet A and tailnet B, and is editing ACLs for tailnet A, using the tailnet\nswitcher in the top-right corner of the page would not clear the cached ACL\nchanges correctly. In some rare cases, saving ACLs of tailnet B after the\nswitch would use the cached ACL contents from tailnet A.\u003c/p\u003e\n\u003cp\u003eA user can be an Admin in multiple tailnets when they use GitHub to log in, and are a member of GitHub organizations, or the user is \u003ca href=\"https://tailscale.com/kb/1271/invite-any-user\"\u003einvited\u003c/a\u003e to another tailnet and granted the Admin role.\u003c/p\u003e\n\u003cp\u003eTailnet switching in the admin console was added on May 22nd, 2023. We fixed\nthis bug on July 17th, 2024.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003eAny user who is an Admin in multiple tailnets and edited ACLs in the admin\nconsole between May 22, 2023 and July 17th, 2024 could trigger this bug after\nswitching the active tailnet.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eAn Admin user could overwrite the ACLs of one tailnet with ACLs from another\ntailnet.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you are an Admin of multiple tailnets using the same login name, review the\nACLs in your tailnets for correctness.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Accidental ACL edits due to browser caching\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eWhen switching tailnets in the admin console, an \u003ca href=\"https://tailscale.com/kb/1138/user-roles#admin\"\u003eAdmin\u003c/a\u003e user\ncould overwrite the \u003ca href=\"https://tailscale.com/kb/1018/acls\"\u003eACLs\u003c/a\u003e of one tailnet with pending changes to ACLs\nfrom another tailnet.\u003c/p\u003e\n\u003cp\u003eWhen a user has unsaved ACL changes in the admin console, those changes are\ncached in browser storage. If this user is a member of multiple tailnets,\ntailnet A and tailnet B, and is editing ACLs for tailnet A, using the tailnet\nswitcher in the top-right corner of the page would not clear the cached ACL\nchanges correctly. In some rare cases, saving ACLs of tailnet B after the\nswitch would use the cached ACL contents from tailnet A.\u003c/p\u003e\n\u003cp\u003eA user can be an Admin in multiple tailnets when they use GitHub to log in, and are a member of GitHub organizations, or the user is \u003ca href=\"https://tailscale.com/kb/1271/invite-any-user\"\u003einvited\u003c/a\u003e to another tailnet and granted the Admin role.\u003c/p\u003e\n\u003cp\u003eTailnet switching in the admin console was added on May 22nd, 2023. We fixed\nthis bug on July 17th, 2024.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003eAny user who is an Admin in multiple tailnets and edited ACLs in the admin\nconsole between May 22, 2023 and July 17th, 2024 could trigger this bug after\nswitching the active tailnet.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eAn Admin user could overwrite the ACLs of one tailnet with ACLs from another\ntailnet.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you are an Admin of multiple tailnets using the same login name, review the\nACLs in your tailnets for correctness.\u003c/p\u003e"
  },
  "title": "TS-2024-010",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2024-010"
  }
}