Debusine is an integrated solution for building and maintaining Debian-based distributions, organizing files into artifacts. The vulnerability CVE-2026-11852 exists because the API endpoints responsible for creating and deleting relationships between these artifacts lack proper permission checks beyond verifying if the user can see the artifacts. This flaw corresponds to CWE-862 (Missing Authorization). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, with low confidentiality and integrity impacts and no availability impact. No known exploits or patches have been reported as of the publication date.

An attacker with network access and no privileges could exploit this vulnerability to alter relationships between artifacts in debusine, potentially leading to unauthorized modification of distribution components. The impact affects confidentiality and integrity at a low level but does not affect availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to debusine endpoints and monitor for unauthorized changes to artifact relationships. No official remediation or temporary fix has been published by the vendor at this time.