CVE-2026-109194: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Quay 3

This vulnerability arises because the build trigger management API in Red Hat Quay 3 fails to confirm that a requested build trigger belongs to the specified repository. Consequently, an authenticated user with administrative privileges on one repository can manipulate build triggers and associated write tokens of other repositories by supplying the UUID of those triggers. This leads to authorization bypass allowing unauthorized access and modification of build triggers across repositories.

An attacker with administrative access to any repository can gain unauthorized access to build triggers and write tokens of other repositories if they know the UUIDs. This can lead to unauthorized modification or deletion of build triggers, potentially disrupting build processes or compromising repository integrity. The CVSS score of 6.4 reflects a medium severity with low privileges required but high impact on integrity and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-109194 for current remediation guidance. Until a fix is available, restrict administrative access to trusted users and avoid sharing trigger UUIDs publicly.