A critical missing authorization vulnerability in Devtron versions 2.2.0 and earlier allows any authenticated user to escalate privileges and gain full platform control.

The application fails to perform necessary authorization checks on the GET /orchestrator/api-token/webhook endpoint. This permits an authenticated attacker to supply arbitrary parameters to the API and receive plaintext super-admin JSON Web Tokens (JWTs) in the response.

Successful exploitation of this vulnerability grants an attacker full administrative control over the Devtron platform. Because the vulnerability exposes plaintext super-admin tokens, the impact includes complete compromise of the CI/CD pipeline, unauthorized access to sensitive deployment configurations, and potential persistence within the infrastructure. With a CVSS score of 8.8, this flaw represents a significant risk to the integrity and confidentiality of the entire software delivery lifecycle.

Immediate Action: Upgrade to the latest available version of Devtron that includes the security patch for this authorization bypass.

Proactive Monitoring: Review API access logs for anomalous requests to the /orchestrator/api-token/webhook endpoint, particularly those originating from non-administrative user accounts.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to sensitive API endpoints and enforce strict RBAC policies where possible until the patch can be deployed.

Public Exploit Available: No (exploit_available: false)

This vulnerability is highly critical due to the ease with which an authenticated user can escalate to full system administrator privileges. Organizations currently running Devtron version 2.2.0 or earlier should prioritize applying the vendor-supplied security updates immediately. Failure to remediate this issue could lead to a total compromise of the platform, enabling attackers to execute arbitrary code or exfiltrate sensitive data across the development and deployment pipeline.