CyberRota Analysis
AI-GeneratedThe Nuclio Dashboard's project management API is vulnerable, allowing any authenticated user to bypass authorization checks and modify or delete projects and their associated resources. This could lead to unauthorized access and manipulation of critical serverless functions and data. Organizations using versions prior to 1.16.0 should prioritize patching this vulnerability to protect their project integrity and data security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.