Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121734ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in zane-ops from zane-ops. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 79.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.

Affected products (as reported)

Vendor	Product	Versions
zane-ops	zane-ops	1.14.0 – before 1.15.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Patch Commit patch
https://github.com/zane-ops/zane-ops product
GitHub Security Advisory (GHSA-r87v-8542-wx9q) vendor-advisory
https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248 technical-description
ZaneOps v1.15.2 Release Notes release-notes
VulnCheck Advisory: ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView third-party-advisory