Authorization Bypass in ZaneOps Product by ZaneOps
CVE-2026-121734

6MEDIUM

Key Information:

Vendor

Zane-ops

Status
Zane-ops
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121734?

An authorization bypass vulnerability exists in ZaneOps versions 1.14.0 to 1.15.2, allowing unauthorized access to pending preview environment data. Workspace administrators can exploit this flaw to access sensitive information by calling the ReviewPreviewEnvDeployAPIView without proper project scoping. This vulnerability enables attackers to extract plaintext environment variables and basic-auth credentials using public data such as project slugs and environment names from fork pull request comments.

Affected Version(s)

zane-ops 1.14.0 < 1.15.2

References

https://github.com/zane-ops/zane-ops/commit/0f3e30403a605...
patch
https://github.com/zane-ops/zane-ops
product
https://github.com/zane-ops/zane-ops/security/advisories/...
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
Fredkiss3
.