{"id":"EUVD-2026-38076","enisaUuid":"51bfcc94-9856-3e9e-ab87-eee9fc9665a1","description":"DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create, update, reapply, and delete VEX rules on those public assets. The same flaw affects the other vulnerability-triage write endpoints exposed under a public asset, including VEX rule create / update / reapply / delete; dependency-vuln event creation (accept / reject / mitigate decisions), batch event creation, vuln sync, and mitigation; license risk creation; external reference writes; and/or artifact creation and license refresh. The attacker needs a valid account on the instance, but no membership in the victim organization, project, or asset is required. Version `v1.4.2`contains a patch. As a workaround, make affected assets non-public. In the asset settings, switch visibility from public to private. This removes the public-read exemption in the access-control middleware and restores correct authorization on all write endpoints for that asset. Downstream consumers that previously relied on the public `vex.json` / `sbom.json` endpoints will need to be granted explicit access or must receive an exported file version until the patched release is deployed.","datePublished":"Jun 19, 2026, 7:38:04 PM","dateUpdated":"Jun 22, 2026, 5:17:21 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N","references":"https://github.com/l3montree-dev/devguard/security/advisories/GHSA-6p54-fw2f-q7gf\nhttps://github.com/l3montree-dev/devguard/commit/1be88ec1309a5dc0566e35a23bdc4ea3ecd11417\n","aliases":"CVE-2026-48089\nGHSA-6p54-fw2f-q7gf\n","assigner":"GitHub_M","epss":0.36,"enisaIdProduct":[{"id":"1ad0776d-62e4-3408-9553-43fccec3cf38","product":{"name":"devguard","vendor":{"name":"l3montree-dev"}},"product_version":"\u003c 1.4.2"}],"enisaIdVendor":[{"id":"a3bdf31c-9cc1-3734-9e3f-ad8de5911e62","vendor":{"name":"l3montree-dev"}}],"enisaIdVulnerability":[{"id":"afc24b4b-7ac4-3b9c-9431-74d7a2abd8df","vulnerability":{"id":"GHSA-6p54-fw2f-q7gf","description":"DevGuard has improper authorization on public assets","datePublished":"Jun 11, 2026, 8:26:18 PM","dateUpdated":"Jul 15, 2026, 9:58:25 PM","baseScore":0.0,"references":"https://github.com/l3montree-dev/devguard/security/advisories/GHSA-6p54-fw2f-q7gf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48089\nhttps://github.com/l3montree-dev/devguard/commit/1be88ec1309a5dc0566e35a23bdc4ea3ecd11417\nhttps://github.com/l3montree-dev/devguard\n","enisa_id":"EUVD-2026-38076\n","aliases":"CVE-2026-48089\nGHSA-6p54-fw2f-q7gf\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ed07c306-63c2-34d0-88ce-0c797cd11805","vulnerability":{"id":"CVE-2026-48089","description":"DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create, update, reapply, and delete VEX rules on those public assets. The same flaw affects the other vulnerability-triage write endpoints exposed under a public asset, including VEX rule create / update / reapply / delete; dependency-vuln event creation (accept / reject / mitigate decisions), batch event creation, vuln sync, and mitigation; license risk creation; external reference writes; and/or artifact creation and license refresh. The attacker needs a valid account on the instance, but no membership in the victim organization, project, or asset is required. Version `v1.4.2`contains a patch. As a workaround, make affected assets non-public. In the asset settings, switch visibility from public to private. This removes the public-read exemption in the access-control middleware and restores correct authorization on all write endpoints for that asset. Downstream consumers that previously relied on the public `vex.json` / `sbom.json` endpoints will need to be granted explicit access or must receive an exported file version until the patched release is deployed.","datePublished":"Jun 19, 2026, 7:38:04 PM","dateUpdated":"Jun 22, 2026, 5:17:21 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N","references":"https://github.com/l3montree-dev/devguard/security/advisories/GHSA-6p54-fw2f-q7gf\nhttps://github.com/l3montree-dev/devguard/commit/1be88ec1309a5dc0566e35a23bdc4ea3ecd11417\n","enisa_id":"EUVD-2026-38076\n","assigner":"GitHub_M","epss":0.36,"dataProcessed":"Nov 7, 2026, 7:22:59 AM","vulnerabilityProduct":[{"id":"c91b646c-cc3b-36df-bcd1-ef2720db21fc","product":{"name":"devguard","vendor":{"name":"l3montree-dev"}},"product_version":"\u003c 1.4.2"}],"vulnerabilityVendor":[{"id":"4c87e283-5343-3fcc-b9bb-0d387c1336a2","vendor":{"name":"l3montree-dev"}}]}}],"enisaIdAdvisory":[]}