Threats tagged 'ghsa-cpgq-jfq6-wqr2'

OpsTree BuildPiper versions before 2.7.0 have a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. This flaw enables attackers to enumerate repositories via a specific API endpoint and clone source code, manifests, and committed secrets from projects they should not have access to.