CVE-2026-45730

8.3 Élevée

Publiée le 02/09/2026 à 19:17 · Modifiée le 09/09/2026 à 23:04 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.

Traduire en français

Produits concernés

nuclio

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.3 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H`

Faiblesses (CWE)

CWE-862

Références

https://github.com/nuclio/nuclio/commit/1915cd26d514dcdd487517d4be56673fc02298e0
https://github.com/nuclio/nuclio/pull/4107
https://github.com/nuclio/nuclio/releases/tag/1.16.0
https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm
https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories