Executive brief
Adminset, an automated operations and DevOps platform, contains a security flaw in its deployment component. A logged-in user with limited permissions can bypass authorization checks to trigger software deployments for projects they are not assigned to. This could lead to unauthorized code rollouts, service disruptions, or the exposure of sensitive project configurations.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Delivery Deployment Endpoint of guohongze adminset up to version 0.61. The component located in `delivery/deli.py` enforces URL-level permissions but fails to validate if the authenticated user has object-level authorization for the specific `project_id` provided in the request. By manipulating the `project_id` argument, a remote attacker with low-privileged credentials can initiate deployment tasks for any project in the system. As of the advisory date, the project maintainers have not responded to the issue report, and no official patch is available.
Affected products
- guohongze adminset up to 0.61
Timeline
- 2026-06-13: disclosed: Issue reported on GitHub by researcher
- 2026-07-19: advisory: CVE published via VulDB/NVD