In project-zot versions prior to 2.1.18, the bearer authentication handler incorrectly maps all HTTP methods other than GET and HEAD to the push action, causing DELETE requests to bypass distinct delete permission checks. Additionally, bearer-authenticated requests bypass the fine-grained DistSpecAuthzHandler path, and DeleteManifest and DeleteBlob functions do not independently verify delete permissions. Consequently, an attacker with a bearer token limited to pull and push actions can delete manifests and blobs within the token's repository scope, making images unavailable and altering repository history despite lacking explicit delete authorization. This vulnerability is addressed in version 2.1.18.

An attacker with a bearer token that only has pull and push permissions can delete manifests and blobs, causing denial of availability of container images and unauthorized modification of repository history. This compromises repository integrity and availability but does not impact confidentiality.

Upgrade project-zot to version 2.1.18 or later, where the issue is fixed. This version correctly enforces delete permissions on DELETE requests and ensures proper authorization checks for delete operations.