Insufficient User Permissions Lead to Robot Account Compromise

CVE-2022-31667

Summary

Harbor contains a vulnerability that arises from improper validation of user permissions when updating robot accounts associated with specific projects. This allows authenticated users to exploit the flaw by sending an unauthorized request aimed at modifying a robot account's details, including its ID and name. If the targeted robot account is linked to a project that the user does not have access to, the system fails to enforce project-level permissions, potentially revoking access rights without proper authorization and compromising the security model.

References