{"action":"Upgrade github.com/akuity/kargo to 1.9.3 or later.","affected":[{"fixed":"1.9.3","introduced":"1.9.0"}],"component":"github.com/akuity/kargo","cve_ids":["CVE-2026-27111"],"ecosystem":"Go","epss":0.00205,"exploited":false,"fixed_versions":["1.9.3"],"ghsa_id":"GHSA-5vvm-67pj-72g4","id":"tcs_01M5KGE6EV550A02WG20FDPW8R","modified_at":"2026-02-23T19:41:13.402645Z","published_at":"2026-02-23T18:23:12Z","references":["https://osv.dev/vulnerability/GO-2026-4515","https://github.com/akuity/kargo/security/advisories/GHSA-5vvm-67pj-72g4","https://github.com/akuity/kargo/commit/833314cad5513d48d89431493325ae44c1324a49"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4515","url":"https://osv.dev/vulnerability/GO-2026-4515"}],"summary":"Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints in github.com/akuity/kargo"}