Mazdak Nasab

**Name of the Vulnerable Software and Affected Versions** Calico (affected versions not specified) **Description** The apiserver fails to invoke the Delete override for `DeleteCollection` requests on `NetworkPolicy`, `GlobalNetworkPolicy`, and their staged variants. This occurs because these resources are wrapped to run through `AuthorizeTierOperation()`, but the specific override is bypassed during bulk deletion. Consequently, a user with the `deletecollection` verb or wildcard permissions can bulk-delete policies in tiers for which they lack authorization, bypassing the tier authorization boundary. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.