CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. auth middleware() protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.can write(), not role.can admin(). tokens page() and tokens list() call store.list all tokens(), exposing IDs and metadata across all users, while tokens revoke() calls store.revoke token using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5.