Authorization bypass vulnerability in Tag Retention Policies

CVE-2022-31670

Summary

A security flaw in Harbor arises from its inability to properly validate user permissions during the process of updating tag retention policies. This vulnerability allows attackers to exploit the system by submitting requests to alter tag retention policies associated with projects to which they do not have legitimate access. Consequently, this can lead to unauthorized modifications and potential security breaches in other projects, posing significant threats to the integrity and confidentiality of data managed within Harbor.

References