CVE-2026-53552
Received Received - Intake

Privilege Escalation in Goploy via Project File Manipulation

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description
Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding model.ProjectFile.GetData and model.Project.GetData queries filter only by row id. A user holding the manager role (or any role that includes the FileSync / EditProject permission) in their own namespace can read, write, or delete files in any project across the install, and can rewrite any project's git remote URL by submitting the foreign id in the body. The git-URL primitive escalates to RCE on the next deploy because Edit runs git remote set-url on the project's working tree. At time of publication, there are no known publicly available patches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-53552
EUVD
EUVD-2026-68725

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zhenorzz goploy to 1.17.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53552 is a critical vulnerability in Goploy versions 1.17.5 and earlier. It allows cross-namespace Insecure Direct Object Reference (IDOR) and Remote Code Execution (RCE) due to improper handling of row IDs in project and project_file handlers. The issue occurs because four endpoints accept project or file IDs from the request body without verifying that the resource belongs to the user's namespace.

Detection Guidance

Check Goploy server logs for suspicious API requests targeting Project.AddFile, Project.EditFile, Project.RemoveFile, or Project.Edit endpoints with unusual project or file IDs. Inspect network traffic for unauthorized Git remote URL modifications or file operations across namespaces.

Impact Analysis

A user with manager privileges in their own namespace can read, write, or delete files in any project across the system. They can also rewrite a project's Git remote URL, leading to RCE during the next deployment when Goploy executes a Git command in the project's working tree.

Compliance Impact

This vulnerability can lead to unauthorized data access and modification, which may violate compliance requirements for data protection and integrity in standards like GDPR and HIPAA. The high impacts on confidentiality and integrity increase the risk of non-compliance.

Mitigation Strategies

Upgrade to a patched version if available. If not, restrict manager roles to least privilege, audit namespace permissions, and implement network-level controls to block unauthorized API access. Monitor for unexpected Git remote URL changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart