## OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

- 種別: advisory
- 重大度: high
- 関連技術: go, github
- CVE: CVE-2026-113727
- 公開日時: 2026-10-21T16:29:53.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-46r4-q7wv-32fc)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-46r4-q7wv-32fc

影響: go:github.com/openchoreo/openchoreo >= 1.0.0, < 1.0.6 → 1.0.6, go:github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.7 → 1.1.7, go:github.com/openchoreo/openchoreo >= 1.2.0, < 1.2.5 → 1.2.5
Summary The OpenChoreo API server authorized PUT .../workflowruns/{runName} against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried entirely by its openchoreo.dev/project and openchoreo.dev/component labels. Because the workflowrun:update check read those labels from the submitted object rather than the stored one, a caller holding…