Executive brief
Anchore Enterprise, a platform used for securing software supply chains and analyzing container images, contains a security flaw in its user management system. An authorized user with low-level access could exploit this vulnerability to grant themselves or others higher permissions, such as changing a read-only account to one with full write access. This could allow an attacker to modify security policies, tamper with analysis results, or access sensitive data they are not authorized to see.
Technical details
An improper privilege escalation vulnerability exists in the Anchore Enterprise RBAC role-membership API. The root cause is a failure to enforce per-account authorization checks on the 'role-member add' endpoint, unlike the corresponding delete endpoint which correctly validates permissions. An authenticated attacker with network access to the API can issue crafted calls to grant themselves or other users account-scoped roles, effectively escalating from read-only to write access. While the 'system-admin' role cannot be granted through this flaw, the vulnerability allows significant unauthorized access to resources and operations. The issue is resolved in versions 5.27.2 and 6.0.1 by implementing proper authorization checks on the affected endpoint.
Affected products
- Anchore Anchore Enterprise 5.11.0 - 5.27.1, 6.0.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched