Threats tagged 'ghsa-wx9v-p2rq-5m8q'

ZaneOps versions from 1.14.0 up to but not including 1.15.2 contain an authorization bypass vulnerability. This flaw allows any workspace administrator to access another workspace's pending preview environment data by querying an API endpoint without proper project scoping. Exploitation can lead to disclosure of plaintext environment variables and preview basic-auth credentials, using information publicly available from fork pull request comments.