Unauthorized Access to Webhook Policies in Harbor

CVE-2022-31666

What is CVE-2022-31666?

Harbor, a popular open-source cloud-native registry, has a vulnerability that allows unauthorized users to manipulate Webhook policies. This issue stems from the application's failure to properly validate user permissions during the deletion of Webhook policies. As a result, malicious actors can gain access to, modify, or delete Webhook configurations established by other users across different projects. This could lead to unauthorized notifications or actions being triggered, compromising the integrity of the application and potentially harmful consequences to related services.

References