CVE-2026-75481

Name of the Vulnerable Software and Affected Versions SkyPilot (affected versions not specified)

Description An authorization bypass exists where the system fails to validate if authenticated users have the necessary entitlements to grant administrator roles when updating service account permissions. This allows an authenticated user to create a service account, escalate its privileges to an administrator role, and use its bearer token to gain full administrative control over all users and workspaces.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.