CVE-2025-14779

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The Secret Type Management REST API fails to correctly isolate access controls during the deletion of a secret type. The on-delete cascade logic does not enforce organizational boundaries, which allows the removal of secrets associated with that type across all organizations. This can lead to unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. Exploitation requires delete permissions for the Secret Type Management REST API, which are typically restricted to administrators.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.