CVE-2026-121734: ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an administrator of any ZaneOps workspace. They can target a different workspace because the affected API endpoint does not enforce project scoping.
What information does an attacker need to retrieve another workspace's preview environment?
The attacker needs the target project slug and environment name. These values may be obtainable from public fork pull request comments.
What data could be exposed?
The issue can expose plaintext environment variables and preview basic-auth credentials associated with a pending preview environment.
Which versions are affected, and what version fixes the issue?
ZaneOps versions from 1.14.0 before 1.15.2 are affected. Upgrading to 1.15.2 or later addresses the vulnerability.