Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request.
CVSS 3.1LOW 3.6·Local·Low privileges·No interaction·EPSS 0.00166·Published 2023-06-30·Fixed in 1.20, 1.20.0CWE-1188