This vulnerability in Harness up to version 2.28.2 affects the getAuthorizedSpaces function in the app/api/controller/gitspace/list_all.go file of the gitspaces endpoint. An attacker can manipulate the function remotely to bypass authorization checks, potentially gaining unauthorized access to resources. The vulnerability has been publicly disclosed, but the vendor has not yet issued a fix or official remediation guidance. The CVSS 4.0 vector indicates the attack requires no user interaction, has low complexity, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to bypass authorization controls remotely, potentially accessing resources or data they should not have permission to access. The impact on confidentiality, integrity, and availability is rated low, but unauthorized access could lead to further security issues depending on the environment.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided a fix, users should monitor vendor advisories for updates. Until a fix is released, consider restricting access to the affected endpoint or implementing additional access controls as a temporary mitigation.