PT-2026-57802 · Google · Colab Enterprise+2
CVSS v4.0
9.4
Critical
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear |
Name of the Vulnerable Software and Affected Versions
Google Cloud BigQuery versions October 2025 through May 10, 2026
Google Cloud Dataform versions October 2025 through May 10, 2026
Google Cloud Colab Enterprise versions October 2025 through May 10, 2026
Description
A missing authorization issue in the repository creation functionality on Google Cloud Platform allows an authenticated attacker to escalate privileges. This can lead to a cross-tenant repository takeover, where an attacker gains unauthorized control over repositories belonging to other tenants.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bigquery
Colab Enterprise
Form-Data