This vulnerability (CWE-862) involves missing authorization checks during repository creation in Google Cloud BigQuery, Dataform, and Colab Enterprise. An authenticated attacker could exploit this to escalate privileges and take over repositories belonging to other tenants. The issue affects the cloud service versions between October 2025 and May 10, 2026. Google patched the vulnerability on May 10, 2026, and has applied mitigations across all impacted services. The CVSS 4.0 base score is 9.4, indicating critical severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and scope.

An authenticated attacker could escalate privileges and perform cross-tenant repository takeover in Google Cloud BigQuery, Dataform, and Colab Enterprise. This could lead to unauthorized access and control over repositories belonging to other tenants, potentially exposing sensitive data or allowing malicious modifications. The vulnerability affects the confidentiality, integrity, and availability of impacted services.

Google has already applied mitigations and patched the vulnerability as of May 10, 2026. No customer action is required. The vendor manages remediation for this cloud-hosted service. Users should verify that their environments are updated per Google's advisory at https://docs.cloud.google.com/support/bulletins#gcp-2026-047.