https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:47:22 +0000 https://cve.radiocsirt.org/vuln/bit-concourse-2022-31683 <p><strong>Affected:</strong> Bitnami: concourse</p> <p>Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.</p> <p><strong>Affected:</strong> Bitnami: concourse</p> <p>Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.</p> https://cve.radiocsirt.org/vuln/bit-concourse-2022-31683 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/euvd-2026-230607 EUVD-2026-230607 https://cve.radiocsirt.org/vuln/euvd-2026-230607 https://cve.radiocsirt.org/vuln/fkie_cve-2022-31683 <p>Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.</p> <p>Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-31683 https://cve.radiocsirt.org/vuln/ghsa-5jp2-vwrj-99rf <p><strong>Affected:</strong> Go: github.com/concourse/concourse</p> <p>### Impact For some Post/Put Concourse endpoint containing `:team_name` in the URL, a Concourse user can send a request with body including `:team_name=team2` to bypass team scope check to gain access to certain resources belong to any other team. The user only needs a valid user session and belongs to team2.</p> <p>Exploitable endpoints: ``` {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/builds/:build_name&#34;, Method: &#34;POST&#34;, Name: RerunJobBuild}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/pause&#34;, Method: &#34;PUT&#34;, Name: PauseJob}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/unpause&#34;, Method: &#34;PUT&#34;, Name: UnpauseJob}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/schedule&#34;, Method: &#34;PUT&#34;, Name: ScheduleJob},</p> <p>{Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/pause&#34;, Method: &#34;PUT&#34;, Name: PausePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/unpause&#34;, Method: &#34;PUT&#34;, Name: UnpausePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/expose&#34;, Method: &#34;PUT&#34;, Name: ExposePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/hide&#34;, Method: &#34;PUT&#34;, Name: HidePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/rename&#34;, Method: &#34;PUT&#34;, Name: RenamePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/archive&#34;, Method: &#34;PUT&#34;, Name: ArchivePipeline},</p> <p>{Path: &#34;/api/v1/teams/:team_name/pipelines/:pipel…</p> <p><strong>Affected:</strong> Go: github.com/concourse/concourse</p> <p>### Impact For some Post/Put Concourse endpoint containing `:team_name` in the URL, a Concourse user can send a request with body including `:team_name=team2` to bypass team scope check to gain access to certain resources belong to any other team. The user only needs a valid user session and belongs to team2.</p> <p>Exploitable endpoints: ``` {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/builds/:build_name&#34;, Method: &#34;POST&#34;, Name: RerunJobBuild}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/pause&#34;, Method: &#34;PUT&#34;, Name: PauseJob}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/unpause&#34;, Method: &#34;PUT&#34;, Name: UnpauseJob}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/schedule&#34;, Method: &#34;PUT&#34;, Name: ScheduleJob},</p> <p>{Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/pause&#34;, Method: &#34;PUT&#34;, Name: PausePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/unpause&#34;, Method: &#34;PUT&#34;, Name: UnpausePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/expose&#34;, Method: &#34;PUT&#34;, Name: ExposePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/hide&#34;, Method: &#34;PUT&#34;, Name: HidePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/rename&#34;, Method: &#34;PUT&#34;, Name: RenamePipeline}, {Path: &#34;/api/v1/teams/:team_name/pipelines/:pipeline_name/archive&#34;, Method: &#34;PUT&#34;, Name: ArchivePipeline},</p> <p>{Path: &#34;/api/v1/teams/:team_name/pipelines/:pipel…</p> https://cve.radiocsirt.org/vuln/ghsa-5jp2-vwrj-99rf https://cve.radiocsirt.org/vuln/gsd-2022-31683 gsd-2022-31683 https://cve.radiocsirt.org/vuln/gsd-2022-31683