Yüksek CVSS 7.5
CVE-2026-119441: CVE-2026-119441: hatalı yetkilendirme
Açıklama (NVD)
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently delete the organization's private repositories, which such a token must not reach. Routes that require organization ownership now reject public-only tokens.
Özet bilgiler
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS
- %0,15 (yüzdelik 4)
- CWE
- CWE-863
- Yama
- Yok / bilinmiyor