OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

影響: go:github.com/openchoreo/openchoreo >= 1.0.0, < 1.0.6 → 1.0.6, go:github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.7 → 1.1.7, go:github.com/openchoreo/openchoreo >= 1.2.0, < 1.2.5 → 1.2.5

The OpenChoreo API server authorized PUT .../workflowruns/{runName} against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried entirely by its openchoreo.dev/project and openchoreo.dev/component labels. Because the workflowrun:update check read those labels from the submitted object rather than the stored one, a caller holding…

在 GitHub Advisory Database 阅读

2026/10/22 01:29，GitHub Advisory Database 发布了“OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Go、GitHub。CVE：CVE-2026-113727。