PT-2026-41144 · Portainer+1 · Portainer Community Edition+1
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Portainer Community Edition versions 2.33.0 through 2.33.7
Portainer Community Edition versions 2.39.0 through 2.39.0
Portainer Community Edition versions prior to 2.33.0
Description
A missing authorization issue in the Custom Template file endpoint "GET /api/custom templates/{id}/file" allows any authenticated user to read the file content of any custom template. This is achieved by enumerating sequential integer IDs in the
id variable, which bypasses Resource Control access restrictions. The customTemplateFile() function retrieves the template by its numeric ID and returns the content without performing an authorization check. Template files may contain sensitive environment-specific values, such as connection strings, API tokens, or registry credentials.Recommendations
Update to version 2.33.8.
Update to version 2.39.1.
Upgrade to a supported release.
Avoid storing secrets in custom templates by moving sensitive configuration values to environment variables or an external secret store.
Review existing custom templates for embedded secrets and rotate any credentials that may have been exposed.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Portainer Community Edition
Red Os