← CVEs and Advisories

CVE-2026-63014

NationalSecurityAgency/skills-service · Severity Medium (CVSS 4.3) · Discovered by Pavan Nallamothu

Status: GitHub Security Advisory GHSA-p527-vjfp-c43p published 2026-07-16 by the National Security Agency, carrying this CVE ID and crediting pavanchow as finder. The CVE record itself is not yet published in the registry.

The validateCopy endpoint failed to enforce object-level authorization, letting a user read and copy objects belonging to other projects (insecure direct object reference).

Summary

Cross-project IDOR in the validateCopy endpoint.

References

GitHub Security Advisory GHSA-p527-vjfp-c43p (published advisory, names this CVE ID and credits pavanchow as finder) · CVE registry record: pending publication