CVE-2026-80348: TarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints
TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching the supplied application and module name, while its sibling uploadPatchPackage, which only stores the package, does check developer authorization first. The only precondition uploadAndPublish enforces is that the named server is registered, and any registered server in the installation satisfies it. downloadPackage and deletePatchPackage select a package by an unscoped sequential primary key covering every application's uploads, and setPatchPackageDefault changes which package a given application deploys by default. Any authenticated account, including one holding a role scoped to a single unrelated application, can therefore push a package to and trigger its deployment on any server the console manages, retrieve or delete any other application's package, and change which package is deployed by default.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the affected endpoints?
Any authenticated TarsWeb account can exploit them, including an account whose role is scoped only to an unrelated application. No authorization check is performed to confirm access to the target application for the affected methods.
What does an attacker need to deploy a package to another application's servers?
The attacker needs a valid authenticated account and the name of a registered server, application, and module. The deployment endpoint only checks that the named server is registered; any registered server in the installation satisfies that condition.
Which actions can an unauthorized authenticated user perform?
They can upload and trigger deployment of a package to servers for another application, download or delete packages belonging to other applications, and change the package selected as an application's default deployment package. Package download and deletion use an unscoped sequential primary key covering uploads across all applications.
How can an organization assess whether it may already have been affected?
Review deployment tasks and package-management activity for actions performed by accounts without roles for the targeted application. Investigate unexpected package uploads, deployments, downloads, deletions, or changes to an application's default package.
What mitigation is supported when patching is not immediately possible?
The provided information does not identify a configuration-based mitigation. Limit access to authenticated TarsWeb accounts as much as possible and monitor or restrict access to the affected patch-management functions until a fix can be applied.