Finding / eve
2026-09-21-eve-cross-principal-authority-queued-messages-from-different-users-ran-under-the-last-sender
Cross-principal authority: queued messages from different users ran under the last sender’s auth. In a shared channel (Slack thread, group chat), queued input from several people was coalesced into one turn and executed with the last sender’s user-scoped connections. That is a privilege-mixing bug, and it sits exactly on the queue path the parent told operators to enable.
Channel: tagged-release. Half: defect. Date: 2026-08-21 to 2026-09-15.
Operator consequence: Anyone who set turnPolicy: "queue" on a
multi-user channel after the parent’s 0.39.3 advice was exposed until 0.52.5.
Upgrade to >= 0.56.0 for all three fixes. Re-audit user-scoped connection
actions taken from shared threads between 0.39.3 and 0.52.5.
Receipt
Finding metadata
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Finding ID: 2026-09-21-eve-cross-principal-authority-queued-messages-from-different-users-ran-under-the-last-sender
Accepted signals
Profile citations
- Eve / claim / queue-auth
Source links
Primary links, including exact changelog lines when available.