CVE-2026-15036: Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization
A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/listall.go of the component gitspaces Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15036?
CVE-2026-15036 has a medium severity score of 4.3.
What does CVE-2026-15036 affect?
CVE-2026-15036 affects the getAuthorizedSpaces function in the list_all.go file of the Harness gitspaces Endpoint.
How do I fix CVE-2026-15036?
To fix CVE-2026-15036, update Harness to version 2.28.3 or later where the vulnerability has been addressed.
Can CVE-2026-15036 be exploited remotely?
Yes, CVE-2026-15036 can be exploited remotely, allowing an attacker to bypass authorization.
What type of vulnerability is CVE-2026-15036?
CVE-2026-15036 is an authorization bypass vulnerability in Harness.