Executive brief
DevGuard, a software supply chain vulnerability management tool, contains a flaw where any logged-in user can modify security data for projects marked as 'public.' An attacker could delete or change vulnerability rules and mitigation status for projects they do not own, potentially hiding security risks from downstream users. This undermines the reliability of the security reports (SBOMs and VEX files) that partners and customers rely on to verify software safety.
Technical details
An improper authorization vulnerability exists in DevGuard's access-control middleware. When an asset is set to 'public,' the system incorrectly applies a public-read exemption to write endpoints, allowing any authenticated user on the instance to bypass membership checks. Attackers can create, update, or delete VEX rules, dependency-vuln events, and license risks for these assets without belonging to the victim organization. This allows for the unauthorized modification of vulnerability triage decisions (accept/reject/mitigate) and artifact data. The issue is fixed in version 1.4.2 by introducing a middleware that explicitly disallows public-access exemptions for write requests.
Affected products
- l3montree-dev devguard < 1.4.2
Timeline
- 2026-05-20: patched: Fix commit 1be88ec pushed to repository
- 2026-05-26: advisory: GitHub Security Advisory GHSA-6p54-fw2f-q7gf published
- 2026-06-19: disclosed: CVE-2026-48089 published to NVD