Threats tagged 'ghsa-v5m8-5455-qw2x'

CVE-2026-53470 is a critical authorization bypass vulnerability in the migration-planner cloud service affecting versions prior to 0.13.5. An authenticated attacker can exploit improper access control in the /api/v1/sources/{id}/image-url endpoint to bypass ownership checks and obtain presigned S3 URLs for OVA images belonging to other users. These images may contain sensitive data such as long-lived agent JWTs and source configurations, potentially enabling unauthorized access and modification of victim sources. A patch is available, and the vendor manages remediation for this cloud-hosted service.