OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

影響: go:github.com/openchoreo/openchoreo >= 1.0.0, < 1.0.6 → 1.0.6, go:github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.7 → 1.1.7, go:github.com/openchoreo/openchoreo >= 1.2.0, < 1.2.5 → 1.2.5

The OpenChoreo API server authorized PUT .../workflowruns/{runName} against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried entirely by its openchoreo.dev/project and openchoreo.dev/component labels. Because the workflowrun:update check read those labels from the submitted object rather than the stored one, a caller holding…

Read on GitHub Advisory Database

On 10/22/2026, 01:29 AM, GitHub Advisory Database published "OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs" (type: Advisory). Severity is "High" (high). Related technologies: Go, GitHub. CVE: CVE-2026-113727.