An authorization bypass vulnerability in Goploy allows authenticated users with manager-level permissions to manipulate projects across different namespaces, leading to remote code execution.

The application fails to validate namespace ownership when processing project and file row identifiers, allowing an authenticated user to perform unauthorized actions on resources belonging to other users. This lack of access control permits the modification of git remote URLs, which results in remote code execution during subsequent deployment operations.

This vulnerability carries a critical CVSS score of 9.6, reflecting the severe risk of unauthorized access and full system compromise. An attacker can manipulate deployment pipelines to execute arbitrary code, potentially leading to data exfiltration, supply chain compromise, and complete loss of control over the automated deployment environment.

Immediate Action: As no official patch is currently available, administrators should restrict access to the Goploy dashboard to highly trusted users only and implement strict network segmentation to limit exposure.

Proactive Monitoring: Monitor server logs for unusual project modification requests, specifically looking for API calls to the project handler that reference unexpected row IDs or changes to git remote configurations.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect JSON payloads and block suspicious API requests attempting to access project or file IDs outside of the user's assigned namespace.

Public Exploit Available: No (exploit_available unknown).

Given the critical nature of this vulnerability and the absence of a vendor-provided fix, organizations must treat this as a high-priority risk. Administrators should proactively audit current user permissions and restrict access to the application interface until a security update is released and verified.