PT-2026-56457 · Undefined · Undefined

Geochen · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-15036

NVD

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/list all.go of the component gitspaces Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-15036

Affected Products

Undefined

References · 7

• 🔥 https://github.com/harness/harness/issues/3689 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-15036 · Security Note
• https://vuldb.com/vuln/376787 · Note
• https://vuldb.com/vuln/376787/cti · Note
• https://vuldb.com/cve/CVE-2026-15036 · Note
• https://vuldb.com/submit/851013 · Note
• https://github.com/harness/harness · Note