Threats Tagged 'ghsa-4rvg-j972-3xw2'

OpenStack Blazar versions before 17.0.1 have a vulnerability in the V2 lease API where object-level authorization is not properly enforced on update and delete operations. This is due to a mismatch in parameter naming during lease lookup, causing authorization to fallback incorrectly. As a result, any authenticated user who knows a lease ID can modify or delete leases owned by other users or projects, bypassing intended ownership checks.