The vulnerability in lakeFS (<=1.83.0) involves missing authentication on the /setup_comm_prefs endpoint. This allows unauthenticated attackers to POST requests that overwrite critical operator metadata, including email, name, and company information, even after the initial setup is completed. Such unauthorized changes can impact security update preferences and telemetry data integrity. The issue was fixed in a commit identified as 71a45ee, indicating versions after 1.83.0 are not affected. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality but limited impact on integrity.

An attacker can bypass authentication to modify operator metadata and security-related preferences, potentially disabling security communications and sending falsified telemetry events. This could reduce the effectiveness of security updates and monitoring, impacting the integrity of security operations and telemetry data. There is no indication of direct confidentiality or availability impact. No known exploits in the wild have been reported.

A fix is available as the vulnerability was resolved in a commit after version 1.83.0 (commit 71a45ee). Users should upgrade to a version including this fix. Since no official vendor advisory or patch link is provided, verify the fix by applying the commit or updating to a later version. Until patched, restrict access to the /setup_comm_prefs endpoint to trusted users or networks as a temporary mitigation.