{"action":"Upgrade github.com/stacklok/minder to 0.0.33 or later.","affected":[{"fixed":"0.0.33","introduced":"0"}],"component":"github.com/stacklok/minder","cve_ids":["CVE-2024-27916"],"ecosystem":"Go","epss":0.00666,"exploited":false,"fixed_versions":["0.0.33"],"ghsa_id":"GHSA-v627-69v2-xx37","id":"tcs_01M5KFNMJK6E13NPXFWRPXEYH0","modified_at":"2026-02-03T03:14:18.945314Z","published_at":"2024-03-05T16:20:07Z","references":["https://osv.dev/vulnerability/GHSA-v627-69v2-xx37","https://github.com/stacklok/minder/security/advisories/GHSA-v627-69v2-xx37","https://nvd.nist.gov/vuln/detail/CVE-2024-27916","https://github.com/stacklok/minder/commit/45750b4e9fb2de33365758366e06c19e999bd2eb","https://github.com/stacklok/minder","https://github.com/stacklok/minder/blob/a115c8524fbd582b2b277eaadce024bebbded508/internal/controlplane/handlers_repositories.go#L277-L278","https://github.com/stacklok/minder/blob/main/internal/controlplane/handlers_repositories.go#L257-L299"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-v627-69v2-xx37","url":"https://osv.dev/vulnerability/GHSA-v627-69v2-xx37"}],"summary":"`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user"}