The vulnerability arises because the handlers Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept project or project-file row IDs from the JSON body and perform actions without verifying namespace ownership. The model queries filter only by row ID without joining on namespace, and permission checks only verify namespace-level permissions without confirming the project belongs to the caller's namespace. A user with the manager role (which includes FileSync and EditProject permissions) in their own namespace can exploit this to access and modify files in any project, and change git remote URLs, leading to RCE when 'git remote set-url' is executed during deployment. The vulnerability is confirmed in the develop HEAD as of 2026-05-27 and in the 1.17.5 Docker image.

An authenticated user with the manager role in their own namespace can read, write, or delete files in any project across the entire Goploy installation, bypassing intended namespace isolation. They can also modify any project's git remote URL, which escalates to remote code execution on the next deployment due to execution of a git command with the attacker-controlled URL. This results in a critical impact affecting confidentiality, integrity, and potentially availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict manager role assignments carefully and monitor for suspicious activity. Avoid exposing the affected API endpoints to untrusted users. Implement additional access control checks to verify that project or file IDs belong to the caller's namespace before performing any actions.