PT-2026-145254
CVE-2026-14242
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization).
Found an issue in the description? Have something to add? Feel free to write us 👾