An authorization bypass vulnerability in zot versions prior to 2.1.18 allows authenticated users to delete container images and modify repository history without the required permissions.

The vulnerability is an improper authorization flaw (CWE-285) located in the bearer authentication handler. An authenticated user with restricted permissions can bypass fine-grained authorization checks, allowing them to execute DELETE operations on manifests and blobs.

The ability for an unauthorized user to delete critical container images can lead to significant service disruption and operational downtime. Furthermore, the capacity to alter repository history undermines the integrity of the software supply chain, potentially leading to the deployment of untrusted or corrupted artifacts. With a CVSS score of 8.1, this high-severity vulnerability poses a substantial risk to both availability and data integrity.

Immediate Action: Update the zot registry to version 2.1.18 or later to incorporate the necessary authorization permission checks.

Proactive Monitoring: Review repository access logs for unusual DELETE activity originating from service accounts or users that do not possess explicit delete privileges.

Compensating Controls: Implement strict network access controls or API gateway policies to limit interactions with the registry, and ensure that bearer tokens are issued with the most restrictive scopes possible.

Public Exploit Available: No

Given the potential for unauthorized data destruction and supply chain compromise, administrators must prioritize upgrading to version 2.1.18 immediately. Verify that all service accounts have the minimum necessary permissions after the update to ensure that the principle of least privilege remains effective against future authorization flaws.