CVE-2026-121734
ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView
- State
- Published
- Severity
- 6.0 Medium
- Published
- Nov 3, 2026
- Updated
- Nov 3, 2026
- Reserved
- Nov 3, 2026
Description
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.0 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
zane-opszane-ops |
|
References
- Patch Commitpatch
- https://github.com/zane-ops/zane-opsproduct
- GitHub Security Advisory (GHSA-r87v-8542-wx9q)vendor-advisory
- https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248technical-description
- ZaneOps v1.15.2 Release Notesrelease-notes
- VulnCheck Advisory: ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIViewthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.