CVE-2026-121734

    Dashboard / Vulnerabilities / CVE-2026-121734

    CVE-2026-121734

    Published: 3 Nov 2026Last Modified: 8 Nov 2026

    Summary: ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView

    Details: ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121734.json, https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2, https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q, https://nvd.nist.gov/vuln/detail/CVE-2026-121734, https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview, https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494, https://github.com/zane-ops/zane-ops, https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- cc8038d5861dfddd851cda7dbe3888a6d707b121
    Fixed -f3d3188df8928c88725422b5b11d8b67019af204

    Affected versions

    v1.15.1
    v1.15.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121734 | CVE-DB