What’s Vulnerable › Vulnerabilities
CVE-2022-31666: Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-14 · updated 2026-06-17
- Weakness: CWE-285
Description
Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects.
Affected products
- Harbor: from 2.0.0 before 2.4.3; from 2.5.0 before 2.5.2 — fixed in 2.4.3, 2.5.2
How to fix
Upgrade to a fixed version: Harbor 2.4.3, 2.5.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2022-31666 or the next vulnerability affects your stack