DevGuard versions before 1.4.2 have an improper authorization flaw affecting API endpoints related to vulnerability management on public assets. Authenticated users without membership in the target organization or project can manipulate VEX rules and other vulnerability triage write endpoints such as dependency vulnerability events, license risk creation, external references, and artifact creation. This occurs because public assets bypass certain access control checks, allowing unauthorized write operations. The issue is resolved in DevGuard version 1.4.2. As a temporary mitigation, changing asset visibility from public to private enforces correct authorization on these endpoints.

An attacker with any valid account on the DevGuard instance can modify critical vulnerability management data on public assets belonging to other organizations without proper authorization. This can lead to unauthorized changes in vulnerability triage decisions, license risk data, and artifact information, potentially undermining the integrity and trustworthiness of the vulnerability management process. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity), reflecting the network attack vector, low attack complexity, and significant impact on integrity and availability.

A patch is available in DevGuard version 1.4.2 that fixes this improper authorization vulnerability. Users should upgrade to version 1.4.2 or later. As a workaround until the patch is applied, administrators can make affected assets non-public by switching their visibility from public to private. This change restores proper access control on write endpoints for those assets. Downstream consumers relying on public endpoints such as vex.json or sbom.json must be granted explicit access or use exported file versions until the update is deployed.