# CVE-2026-15036: Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization

> CVE-2026-15036: Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization. CVSS 4.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-15036
Last updated: 2026-07-09T16:20:12Z

- Published: 2026-07-08 14:30 UTC · Updated: 2026-07-09 16:20 UTC · Assigner: VulDB
- CVSS: 4.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
- EPSS: 0.41%, 35th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-285, CWE-639

## Description

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/list\_all.go of the component gitspaces Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

## Affected vendors and products

- n/a: Harness

## Tracked companies

- [Harness](https://rewindex.com/company/harness.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-15036)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-15036)
- [https://github.com/harness/harness/](https://github.com/harness/harness/)
- [https://github.com/harness/harness/issues/3689](https://github.com/harness/harness/issues/3689)
- [https://vuldb.com/cve/CVE-2026-15036](https://vuldb.com/cve/CVE-2026-15036)
- [https://vuldb.com/submit/851013](https://vuldb.com/submit/851013)
- [https://vuldb.com/vuln/376787](https://vuldb.com/vuln/376787)
- [https://vuldb.com/vuln/376787/cti](https://vuldb.com/vuln/376787/cti)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-15036 · Markdown: https://rewindex.com/cve/CVE-2026-15036.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-15036 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:19.511Z