Description

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-12T16:17:13.393Z",
  "pubdate": "2026-08-12T16:17:13.393Z",
  "executiveSummary": "This vulnerability involves an information disclosure flaw where sensitive metadata pertaining to private Release Bundles can be queried and exposed.\nThe vulnerability allows unauthorized or low-privileged actors to enumerate private Release Bundle names and versions, provided they have prior knowledge of the target bundle name.\nThe impact includes the leakage of proprietary release structures and versioning intelligence, which can facilitate targeted follow-up attacks or supply chain reconnaissance.\nThe affected systems include environments where anonymous access is explicitly enabled or where low-privilege authentication is utilized.\nAttacker capabilities are constrained to read operations, requiring anonymous unauthenticated access or low-privilege credentials alongside partial prior knowledge of the bundle nomenclature.\nThe risk implication centers on unauthorized reconnaissance, breaching confidentiality boundaries within the software delivery pipeline.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient access control enforcement and authorization checks within the endpoint handling Release Bundle queries.\nWhen anonymous access is enabled or when a request is issued by a low-privileged authenticated user, the application fails to adequately validate whether the requesting entity possesses the necessary permissions to inspect private Release Bundle metadata.\nThe vulnerable component handles API requests or internal function calls associated with Release Bundle enumeration and retrieval.\nThe attack flow begins with an attacker identifying an environment with anonymous access enabled or authenticating with low-privilege credentials.\nIn the second phase, the attacker leverages partial knowledge or guesses a target Release Bundle name, supplying it as a parameter to the vulnerable query interface.\nThe backend subsystem processes the request without enforcing strict tenant or role-based access control (RBAC) boundaries against the private Release Bundle repository.\nConsequently, the application responds with sensitive metadata, revealing the precise private Release Bundle names and associated version identifiers to an unauthorized entity.\nAuthentication requirements for exploitation are minimal, encompassing either entirely unauthenticated anonymous access or standard low-privilege user authentication.\nPrivilege requirements are similarly restricted, allowing actors operating at the lowest security tier to harvest confidential delivery metadata.\nNetwork exposure is dictated by the accessibility of the vulnerable service interface, typically residing on standard HTTP or HTTPS management or API ports.\nThe post-exploitation impact is characterized by unauthorized information disclosure, enabling the adversary to map internal release cadences, proprietary project names, and specific version iterations for further exploitation vectors."
}