API Permission Elevation Vulnerability in Codefresh Platform
CVE-2026-12878
8.6HIGH
What is CVE-2026-12878?
The Codefresh platform has a security vulnerability that allows authenticated users to exploit an API endpoint, granting them unauthorized Admin permissions. This flaw can potentially lead to significant security breaches, allowing users to access sensitive information and alter settings without proper authorization. It is crucial for users to assess their systems and apply necessary patches to mitigate risks associated with this vulnerability.
Affected Version(s)
Codefresh Windows 2.0.0 < 2.11.15
References
CVSS V4
Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This vulnerability was found during internal testing by Codefresh Platform Team at Octopus Deploy