{"id":"EUVD-2026-64181","enisaUuid":"3ec46cdb-15fd-3329-b117-ddb4917f0c2f","description":"Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) \u003e 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.","datePublished":"Aug 21, 2026, 9:35:41 PM","dateUpdated":"Aug 25, 2026, 4:47:05 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8\n","aliases":"CVE-2026-53487\nGHSA-gvhc-wv3v-7pf8\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"ab402ea1-1e4f-3e83-bf06-a7af5fa0878b","product":{"name":"Kite","vendor":{"name":"Kite"}},"product_version":"\u003c 0.12.3"}],"enisaIdVendor":[{"id":"b5173b7a-1fc2-30cd-8066-40e4a867e200","vendor":{"name":"kite-org"}}],"enisaIdVulnerability":[{"id":"c22a2135-31b4-3a7f-9f43-dcf833168e5f","vulnerability":{"id":"CVE-2026-53487","description":"Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) \u003e 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.","datePublished":"Aug 21, 2026, 9:35:41 PM","dateUpdated":"Aug 25, 2026, 4:47:05 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8\n","enisa_id":"EUVD-2026-64181\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 1, 2026, 7:17:24 AM","vulnerabilityProduct":[{"id":"04916d08-ce66-3555-8a56-568b820e9b75","product":{"name":"Kite","vendor":{"name":"Kite"}},"product_version":"\u003c 0.12.3"}],"vulnerabilityVendor":[{"id":"2303942b-0803-337c-8555-8ef1d541ba18","vendor":{"name":"kite-org"}}]}},{"id":"c969654d-4028-3146-ad3a-e780ab3d5c86","vulnerability":{"id":"GHSA-gvhc-wv3v-7pf8","description":"Kite has an authenticated cluster RBAC bypass in /api/v1/overview","datePublished":"Jul 7, 2026, 11:40:35 PM","dateUpdated":"Jul 7, 2026, 11:40:35 PM","baseScore":0.0,"references":"https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8\nhttps://github.com/kite-org/kite\n","enisa_id":"EUVD-2026-64181\n","aliases":"GHSA-gvhc-wv3v-7pf8\nCVE-2026-53487\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}