CVE-2026-53552

Name of the Vulnerable Software and Affected Versions goploy version 1.17.5

Description An Insecure Direct Object Reference (IDOR) exists in the project and project-file handlers. The application fails to verify if a project or project-file belongs to the caller's namespace when processing requests. A user with the manager role in their own namespace can read, write, or delete files in any project across the installation and modify any project's metadata.

Technical details include:

By modifying the git remote URL via the /project/edit endpoint, an attacker can achieve Remote Code Execution (RCE) during the next deployment, as the system executes git remote set-url on the project's working tree.

Recommendations For version 1.17.5, implement namespace-scoped lookups in the model layer by requiring both the row ID and the namespace id for all data retrieval operations.

As a temporary mitigation, restrict access to the /project/addFile, /project/editFile, /project/removeFile, and /project/edit endpoints to only trusted administrative users.