Description
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Concourse | Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/concourse/concourse | < 6.7.9 | 6.7.9 | GHSA-5jp2-vwrj-99rf |
| Go | github.com/concourse/concourse | >= 7.0.0, < 7.8.3 | 7.8.3 | GHSA-5jp2-vwrj-99rf |