MEDIUM 6.0 NVD
CVE-2026-121734
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.
References
- https://github.com/zane-ops/zane-ops
- https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L
- https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494
- https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2
- https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q
This medium severity vulnerability with a CVSS score of 6.0 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18613 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.