Authorization Bypass in NORA Artifact Registry Affects Security Management

CVE-2026-59164

What is CVE-2026-59164?

The NORA artifact registry faces a significant security issue where the token-management UI authenticates users but erroneously fails to enforce administrator authorization for state-changing requests. While the auth_middleware() effectively protects critical endpoints, it inadequately checks permissions by relying solely on role.can_write() instead of the more stringent role.can_admin(). This oversight allows unauthorized users to access sensitive token information, including IDs, owner details, and metadata. Moreover, with specific bearer tokens, users can revoke arbitrary admin tokens, jeopardizing registry functionality and security. This vulnerability is addressed in version 0.9.5, and it is crucial for NORA users to update to this version to mitigate risks.

References