{"id":"ghsa-ghsa-46r4-q7wv-32fc","seq":32751,"kind":"advisory","title":"OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs","url":"https://github.com/advisories/GHSA-46r4-q7wv-32fc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-46r4-q7wv-32fc","summary":"影響: go:github.com/openchoreo/openchoreo >= 1.0.0, < 1.0.6 → 1.0.6, go:github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.7 → 1.1.7, go:github.com/openchoreo/openchoreo >= 1.2.0, < 1.2.5 → 1.2.5\nSummary The OpenChoreo API server authorized PUT .../workflowruns/{runName} against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried entirely by its openchoreo.dev/project and openchoreo.dev/component labels. Because the workflowrun:update check read those labels from the submitted object rather than the stored one, a caller holding…","severity":"high","techs":["go","github"],"cves":["CVE-2026-113727"],"tags":["GHSA-46r4-q7wv-32fc","github.com/openchoreo/openchoreo","github.com/openchoreo/openchoreo","github.com/openchoreo/openchoreo"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T16:29:53.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}