An authenticated privilege escalation vulnerability in the Codefresh platform allows users to bypass access controls and obtain administrative privileges.

The application contains a flaw in an API endpoint that fails to properly enforce access control checks, allowing an authenticated user to perform an action that results in elevation to Admin status. This is a critical failure in the authorization model of the platform.

Unauthorized elevation to administrative privileges provides an attacker with full control over the Codefresh deployment platform. With a CVSS score of 8.6, this vulnerability could be used to modify pipelines, access secrets, or deploy malicious code into production environments, leading to severe reputational and operational damage.

Immediate Action: Update the Codefresh platform to version 2.11.15 or later immediately.

Proactive Monitoring: Review audit logs for API calls that indicate unexpected privilege changes or administrative actions performed by non-administrative user accounts.

Compensating Controls: Implement strict API gateway policies to limit access to sensitive administrative endpoints to authorized service accounts only.

Public Exploit Available: No (exploit_available: false)

Privilege escalation vulnerabilities are critical as they undermine the entire security model of the application. Organizations must apply the vendor-provided update immediately to prevent unauthorized administrative access and potential supply chain compromise.