Authorization Bypass in Harness Gitspaces Endpoint

Executive Summary

CVE-2026-15036 is an authorization bypass vulnerability in the Harness platform affecting the getAuthorizedSpaces function in the gitspaces endpoint. The issue arises because the code does not properly enforce space-level authorization checks. Specifically, when a user is removed from a space, the function fails to skip marking that space as authorized due to missing control flow logic. This allows an authenticated user, even after removal, to access gitspace configurations they should no longer have permission to see.

The vulnerability allows the user to retrieve sensitive information such as access keys, SSH commands, and URLs from gitspaces they are no longer authorized to access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized access to sensitive gitspace configurations after you have been removed from a space. An attacker or unauthorized user could retrieve access keys and connection details, potentially continuing to access and manipulate development environments remotely.

If a gitspace instance remains running after a user is removed, the exposed access keys could be used to maintain unauthorized access, leading to potential data exposure or manipulation within your development environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring access to the `GET /api/v1/gitspaces` endpoint on the Harness platform. Specifically, look for unauthorized retrievals of gitspace configurations from spaces where the user should no longer have access.

Since the issue involves an authorization bypass in the `getAuthorizedSpaces()` function, detection can involve checking logs for requests to the gitspaces endpoint by users who have been removed from certain spaces but still receive data from those spaces.

No explicit detection commands are provided in the available resources, but network monitoring tools or API request logs can be queried for suspicious access patterns to `/api/v1/gitspaces`.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the `GET /api/v1/gitspaces` endpoint to only fully authorized users and monitoring for any unauthorized access attempts.

Since the vulnerability allows users removed from a space to still access its gitspace configurations, it is important to revoke or rotate any exposed access keys or credentials associated with those gitspaces.

Additionally, consider disabling or limiting the use of gitspace instances for users who have been removed until a patch or fix is available.

Currently, the project has not responded with a fix, so monitoring for updates and applying patches once available is critical.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user who has been removed from a space to bypass authorization and access sensitive gitspace configurations, including access keys, SSH commands, and URLs. This unauthorized access to sensitive information could lead to exposure of personal or confidential data.

Such unauthorized access and potential data exposure may impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data.

However, the provided information does not explicitly state the direct impact on compliance with these regulations.

Useful 0 Not Useful 0