Authorization Flaw in TarsWeb Affects Deployment and Package Management

CVE-2026-80348

What is CVE-2026-80348?

TarsWeb exhibits an authorization vulnerability where certain methods within the application do not properly enforce role checks, leading to unauthorized access. Specifically, the methods uploadAndPublish, downloadPackage, and deletePatchPackage can be exploited by any authenticated user, allowing them to trigger deployments, retrieve, or delete any application's packages indiscriminately. The lack of adequate validation means an attacker with a scoped role can perform actions intended for unrelated applications, compromising the integrity and security of the system. This critical oversight highlights the need for stringent authorization checks across all functions and endpoints.

References