Search
Find a vulnerability
Search criteria
1 vulnerability by zane-ops
CVE-2026-121734 (GCVE-0-2026-121734)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:55 – Updated: 2026-11-07 03:38
VLAI
EPSS
VEX
Title
ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView
Summary
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:38 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/zane-ops/zane-ops/commit/0f3e3… | patch |
| https://github.com/zane-ops/zane-ops | product |
| https://github.com/zane-ops/zane-ops/security/adv… | vendor-advisory |
| https://github.com/zane-ops/zane-ops/blob/v1.15.1… | technical-description |
| https://github.com/zane-ops/zane-ops/releases/tag… | release-notes |
| https://www.vulncheck.com/advisories/zaneops-1.14… | third-party-advisory |
Impacted products
Date Public
2026-11-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121734",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:38:13.932833Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:38:38.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/zane-ops/zane-ops",
"product": "zane-ops",
"vendor": "zane-ops",
"versions": [
{
"lessThan": "1.15.2",
"status": "affected",
"version": "1.14.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Fredkiss3"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace\u0027s pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:55:38.573Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494"
},
{
"tags": [
"product"
],
"url": "https://github.com/zane-ops/zane-ops"
},
{
"name": "GitHub Security Advisory (GHSA-r87v-8542-wx9q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248"
},
{
"name": "ZaneOps v1.15.2 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2"
},
{
"name": "VulnCheck Advisory: ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview"
}
],
"title": "ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121734",
"datePublished": "2026-11-03T22:55:38.573Z",
"dateReserved": "2026-11-03T22:17:05.334Z",
"dateUpdated": "2026-11-07T03:38:38.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}