CVE-2026-109194: Quay: build trigger uuid idor in quay api
A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build triggers and associated write tokens of another repository if they know the victim trigger's universally unique identifier (UUID).
Other sources
A flaw was found in Red Hat Quay. The build trigger management endpoints (GET, PUT, DELETE on /api/v1/repository/<repository>/trigger/<triggeruuid>) resolve the trigger object by its global UUID without verifying that the trigger belongs to the repository specified in the request URL. The requirerepoadmin decorator only authorizes the caller against the URL namespace/repository, not against the object a handler loads. As a result, any user who is admin of any repository can read another repository's build trigger configuration, disable it, or permanently delete it (along with its delegate write token) by supplying the target trigger's UUID. Exploitation requires knowledge of the victim trigger's random v4 UUID, which is not normally visible across organizations. The vulnerability is in endpoints/api/trigger.py, specifically the BuildTrigger class get/put/delete methods, which all call gettrigger(triggeruuid) - a UUID-only lookup with no repository/namespace scoping. The sibling endpoint BuildTriggerAnalyze.post already has the correct ownership check, confirming this is an oversight.
— Red Hat