TIDES-2026-002criticalCVSS 9.3

Account linking accepted untrusted email claims

From March 18 through June 15, 2026, some legacy and pre-created account-linking paths could rely on a caller-controlled or insufficiently assured email claim. Tides corrected every linking branch and now accepts ownership only from trusted Clerk identity or webhook data.

Published Aug 7, 2026 · Last updated Aug 7, 2026

Affected surfaces

Client account creation and synchronization
Pre-created and migrated account linking
Clerk webhook identity synchronization

Affected period

March 18 through June 15, 2026

Impact

Successful exploitation could have linked an authenticated attacker to another person's pre-created or migrated Tides account. Depending on the target, this could have exposed account data or inherited staff permissions. Tides found no evidence of exploitation.

Remediation

Tides centralized account-link policy, removed caller-supplied email as an ownership signal, required trusted Clerk identity or webhook data, rejected ambiguous duplicate candidates, and added regression coverage for legacy and role-bearing account states.

Customer action

No action is required. Customers who notice an unfamiliar sign-in or profile change should contact security@mail.tidespilates.com.

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Acknowledgments

Tides Pilates internal security review