Threats tagged 'ghsa-fr9x-v7ch-736m'

OpsTree BuildPiper versions prior to 2.7.0 have an authorization bypass vulnerability. Authenticated users can exploit this flaw by supplying a foreign project_env_id to attach another application's environment to their service. This allows attackers to configure continuous integration (CI) pipelines and trigger builds and deployments using the victim application's configuration, registries, and deployment infrastructure.