{"action":"Upgrade github.com/akuity/kargo to 1.9.3 or later.","affected":[{"fixed":"1.9.3","introduced":"1.9.0"}],"component":"github.com/akuity/kargo","cve_ids":["CVE-2026-27111"],"ecosystem":"Go","epss":0.00321,"exploited":false,"fixed_versions":["1.9.3"],"ghsa_id":"GHSA-5vvm-67pj-72g4","id":"tcs_01M5KEYX19G8BSFEXJY3FSVYDA","modified_at":"2026-02-23T23:43:52.273391Z","published_at":"2026-02-19T15:16:31Z","references":["https://osv.dev/vulnerability/GHSA-5vvm-67pj-72g4","https://github.com/akuity/kargo/security/advisories/GHSA-5vvm-67pj-72g4","https://nvd.nist.gov/vuln/detail/CVE-2026-27111","https://github.com/akuity/kargo/commit/833314cad5513d48d89431493325ae44c1324a49","https://github.com/akuity/kargo"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-5vvm-67pj-72g4","url":"https://osv.dev/vulnerability/GHSA-5vvm-67pj-72g4"}],"summary":"Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints"}