CVE-2026-111672 Details

A missing authorization vulnerability has been identified in Cube-Studio versions through 2026.09.01. This vulnerability, located in the 'myapp/views/view_pipeline.py' file, allows authenticated users to access or duplicate pipelines from other project groups by using the pipeline ID. Exploitation involves enumerating pipeline IDs through various endpoints, which can lead to unauthorized access to sensitive data such as DAGs, cluster names, namespaces, Argo workflow IDs, and pod names. Additionally, the vulnerability allows for the cloning of pipelines.

The vulnerability can be addressed by adding proper authorization checks to the affected endpoints, ensuring that only authorized users can access or modify resources. This involves implementing project-membership checks and ownership verifications, similar to the existing safeguards on other pipeline-related functions.