Executive brief
Harness is a developer platform used for managing software delivery, including source code and development environments. A security flaw in the Gitspaces component allows users who have had their access revoked to still view and access their previous development environments. This could lead to unauthorized access to private code repositories, SSH commands, and active development instances even after a user has been removed from a project.
Technical details
An authorization bypass exists in the `getAuthorizedSpaces` function within `app/api/controller/gitspace/list_all.go`. The vulnerability is caused by a logic error where the code fails to include a `continue` statement after identifying a 'no access' error from the `CheckGitspace` authorization check. Consequently, the execution flow falls through and unconditionally marks the space as authorized. An authenticated attacker can exploit this by calling the `GET /api/v1/gitspaces` endpoint to retrieve sensitive configuration data—including AccessKeys, SSH commands, and private repository URLs—for spaces from which their membership has been revoked. As of the advisory date, the project has been notified but a formal patch has not been confirmed.
Affected products
- Harness Harness up to 2.28.2
Timeline
- 2026-05-19: disclosed: Issue reported via GitHub issue #3689
- 2026-07-08: advisory: CVE published to NVD