In goploy versions 1.17.5 and prior, several API handlers (Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit) accept project or project-file row IDs from JSON input and perform actions without verifying that the project belongs to the caller's namespace. The underlying data queries filter only by row ID, not ownership. Consequently, a user with manager role or roles including FileSync/EditProject permissions can manipulate files or project settings across the entire installation. Specifically, the ability to rewrite the git remote URL escalates to remote code execution because the Edit handler runs 'git remote set-url' on the project's working tree during deployment. At the time of publication, no official patches or fixes are available.

An attacker with manager-level permissions in their own namespace can bypass authorization controls to access and modify files in any project on the goploy installation. This includes reading, writing, and deleting files arbitrarily. Furthermore, the attacker can change the git remote URL of any project, which leads to remote code execution during the next deployment process. This vulnerability compromises confidentiality, integrity, and can lead to full system compromise. There are no known public exploits in the wild yet.

At the time of this report, no official patches or fixes are available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict manager and FileSync/EditProject permissions to trusted users only and consider limiting access to the deployment system to reduce risk.