TI-2022-13585 Aliases CVE-2022-31666 GHSA-jf8p-3vjh-pq94

Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies

LOW 34CWE-285Published 2024-11-14 · Updated 2024-11-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00495 42nd percentileScored 2026-11-07

Fix Fixed github.com/goharbor/harbor (Go): 1.10.13, 2.4.3, 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Harbor	Harbor 2.x<=2.4.2; 2.5<=2.5.1	—	No fix listed	CNA
—	github.com/goharbor/harbor (Go)	1.0.0 to before 1.10.13	1.10.13	Patch available	GHSA-jf8p-3vjh-pq94
—	github.com/goharbor/harbor (Go)	2.0.0 to before 2.4.3	2.4.3	Patch available	GHSA-jf8p-3vjh-pq94
—	github.com/goharbor/harbor (Go)	2.5.0 to before 2.5.2	2.5.2	Patch available	GHSA-jf8p-3vjh-pq94

Harbor Vendor— Affected Harbor 2.x<=2.4.2; 2.5<=2.5.1 Fixed in — No fix listed CNA
github.com/goharbor/harbor (Go) Vendor— Affected 1.0.0 to before 1.10.13 Fixed in 1.10.13 Patch available GHSA-jf8p-3vjh-pq94
github.com/goharbor/harbor (Go) Vendor— Affected 2.0.0 to before 2.4.3 Fixed in 2.4.3 Patch available GHSA-jf8p-3vjh-pq94
github.com/goharbor/harbor (Go) Vendor— Affected 2.5.0 to before 2.5.2 Fixed in 2.5.2 Patch available GHSA-jf8p-3vjh-pq94

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:harbor::::::::	2.0.0 to before 2.4.3; 2.5.0 to before 2.5.2	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.4.3; 2.5.0 to before 2.5.2 Vulnerable ·backstage

Remediation

Fix · GHSA-jf8p-3vjh-pq94 github.com/goharbor/harbor (Go) Fixed in 1.10.13 Advisory →
Fix · GHSA-jf8p-3vjh-pq94 github.com/goharbor/harbor (Go) Fixed in 2.4.3 Advisory →
Fix · GHSA-jf8p-3vjh-pq94 github.com/goharbor/harbor (Go) Fixed in 2.5.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-31666
2026-10-03 Alias added: GHSA-jf8p-3vjh-pq94

References

Advisory 2

Other 2

TI-2019-13717 Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows… CVSS 3.1MEDIUM 5.3
TI-2019-12090 core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin… CVSS 3.1MEDIUM 6.5
TI-2022-22962 An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and… CVSS 3.1HIGH 7.5
TI-2026-03829 Hard-coded credentials in backstage Harbor CVSS 3.1CRITICAL 9.4
TI-2019-13713 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege… CVSS 3.1HIGH 8.8
TI-2019-13714 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the… CVSS 3.1HIGH 8.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences