CVE-2026-79767 is an authorization bypass vulnerability in the Gardener API server's customverbauthorizer admission plugin. The vulnerability arises because the authorization check for the 'manage-members' custom verb only enforces permissions on User-kind subjects, ignoring Group and ServiceAccount subjects. This allows a project admin without 'manage-members' permission to add arbitrary Group subjects, such as 'system:authenticated', to a project's member list, effectively granting all authenticated users full project-level access.