{"items":[{"id":"NVI-00010637","kind":"vulnerability","title":"Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-26rh-24rg-j3vv","CVE-2026-53552"],"plain_summary":"GitHub lists this reviewed advisory for github.com/zhenorzz/goploy. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-7cd07af8b576043e186046e4c90124c2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T15:13:03.000Z","value":"9.6 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-7c64fc1a8802d44048fc30da0f0ee951"},{"kind":"CVSS","as_of":"2026-09-08T21:11:31.703Z","value":"9.6 CRITICAL (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-7cd07af8b576043e186046e4c90124c2"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7c64fc1a8802d44048fc30da0f0ee951","url":"https://github.com/advisories/GHSA-26rh-24rg-j3vv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-26rh-24rg-j3vv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"},{"id":"sr-7cd07af8b576043e186046e4c90124c2","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53552","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-53552","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T22:35:42.883Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7c64fc1a8802d44048fc30da0f0ee951"],"technology":"github.com/zhenorzz/goploy","known_exclusions":[],"conditions_summary":"### Summary\n\n`Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` in `cmd/server/api/project/handler.go` accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding `model.ProjectFile.GetData` and `model.Project.GetData` queries filter only by row id. A user holding the `manager` role (or any role that includes the `FileSync` / `EditProject` permission) in their own namespace can read, write, or delete files in any project across the install, and can rewrite any project's git remote URL by submitting the foreign id in the body. The git-URL primitive escalates to RCE on the next deploy because `Edit` runs `git remote set-url` on the project's working tree.\n\n### Affected\n\n`zhenorzz/goploy` `develop` HEAD as of 2026-05-27. Verified against the `zhenorzz/goploy:1.17.5` Docker image (`docker.io/zhenorzz/goploy@sha256:69d08e1d16d7a7167426c89456c4bcef8e077a16554a4067ff258fff26d5cd44`).\n\nThe four handlers and the model lookups have been in this shape across the file API and project metadata API.\n\n### Vulnerable code\n\n`cmd/server/api/project/handler.go::AddFile` (cr","public_affected_ranges":["<= 1.17.5"]}],"null_published_at":"2026-11-08T15:11:49.375Z","source_updated_at":"2026-10-27T15:13:03.000Z","source_disclosed_at":"2026-07-07T23:42:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T22:06:46.371Z"},{"id":"NVI-00010637","kind":"vulnerability","title":"Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-26rh-24rg-j3vv","CVE-2026-53552"],"plain_summary":"GitHub lists this reviewed advisory for github.com/zhenorzz/goploy. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-7c64fc1a8802d44048fc30da0f0ee951"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T15:13:03.000Z","value":"9.6 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-7c64fc1a8802d44048fc30da0f0ee951"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7c64fc1a8802d44048fc30da0f0ee951","url":"https://github.com/advisories/GHSA-26rh-24rg-j3vv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-26rh-24rg-j3vv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7c64fc1a8802d44048fc30da0f0ee951"],"technology":"github.com/zhenorzz/goploy","known_exclusions":[],"conditions_summary":"### Summary\n\n`Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` in `cmd/server/api/project/handler.go` accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding `model.ProjectFile.GetData` and `model.Project.GetData` queries filter only by row id. A user holding the `manager` role (or any role that includes the `FileSync` / `EditProject` permission) in their own namespace can read, write, or delete files in any project across the install, and can rewrite any project's git remote URL by submitting the foreign id in the body. The git-URL primitive escalates to RCE on the next deploy because `Edit` runs `git remote set-url` on the project's working tree.\n\n### Affected\n\n`zhenorzz/goploy` `develop` HEAD as of 2026-05-27. Verified against the `zhenorzz/goploy:1.17.5` Docker image (`docker.io/zhenorzz/goploy@sha256:69d08e1d16d7a7167426c89456c4bcef8e077a16554a4067ff258fff26d5cd44`).\n\nThe four handlers and the model lookups have been in this shape across the file API and project metadata API.\n\n### Vulnerable code\n\n`cmd/server/api/project/handler.go::AddFile` (cr","public_affected_ranges":["<= 1.17.5"]}],"null_published_at":"2026-10-31T22:27:09.626Z","source_updated_at":"2026-10-27T15:13:03.000Z","source_disclosed_at":"2026-07-07T23:42:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:06:46.371Z"}],"next_cursor":null,"snapshot_revision":"42594"}