Insufficient Access Control in Gittuf by Gittuf Corp

CVE-2026-128037

What is CVE-2026-128037?

In Gittuf versions 0.10.0 to 0.15.0, a significant access control vulnerability allows users to bypass authorization checks. When a global rule and a policy rule protect the same namespace, the global rule takes precedence over the policy rule's own authorized users. This flaw permits users who should be restricted by the policy to make changes in the protected namespace, posing a severe risk to system integrity and security.

References