Threats affecting pkg:github/zane-ops

ZaneOps versions 1.14.0 through 1.15.1 contain an authorization bypass vulnerability that allows any workspace administrator to access another workspace's pending preview environment data. This occurs due to lack of project scoping in the ReviewPreviewEnvDeployAPIView endpoint. Exploitation can lead to disclosure of plaintext environment variables and preview basic-auth credentials by leveraging publicly available project slugs and environment names from fork pull request comments. The issue is fixed in version 1.15.2.