CVE-2026-15036: Harness Authorization Bypass Vulnerability

CVE-2026-15036 Overview

CVE-2026-15036 is an authorization bypass vulnerability in Harness versions up to 2.28.2. The flaw resides in the getAuthorizedSpaces function within app/api/controller/gitspace/list_all.go, part of the gitspaces Endpoint component. An authenticated remote attacker can manipulate requests to bypass authorization checks and access resources outside their permitted scope. The exploit has been publicly disclosed. According to VulDB, the project was notified through an issue report but has not responded. The weakness is categorized under [CWE-285: Improper Authorization].

Critical Impact

Authenticated remote attackers can bypass authorization controls in the gitspaces API and enumerate or access spaces they should not be permitted to view.

Affected Products

• Harness versions up to and including 2.28.2
• Component: gitspaces Endpoint
• Affected file: app/api/controller/gitspace/list_all.go

Discovery Timeline

• 2026-07-08 - CVE-2026-15036 published to NVD
• 2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15036

Vulnerability Analysis

The vulnerability affects the getAuthorizedSpaces function in the gitspaces list endpoint. This function is responsible for determining which spaces an authenticated user is authorized to see when calling the list-all API. Improper enforcement of authorization checks allows a low-privileged authenticated user to receive or interact with spaces beyond their permission boundary.

Because the flaw lives in the authorization layer rather than authentication, valid credentials with minimal privileges are sufficient to trigger it. The confidentiality impact is limited to information the attacker retrieves through the endpoint, and neither integrity nor availability of the platform is directly affected according to the CVSS vector metrics.

Root Cause

The root cause is improper authorization logic ([CWE-285]) inside getAuthorizedSpaces. The function does not correctly restrict the set of spaces returned to the requesting principal, treating scope checks as insufficient or incomplete. This creates a broken access control condition where server-side authorization does not match the intended permission model.

Attack Vector

The attack is executed over the network against the Harness API. An attacker holding valid low-privileged credentials issues crafted requests to the gitspaces list endpoint. Because the exploit has been publicly disclosed, opportunistic exploitation against exposed Harness deployments is plausible. No user interaction is required.

No verified proof-of-concept code is available in the referenced advisories. Technical details are tracked in the GitHub Harness Repository, the GitHub Issue #3689, and the VulDB CVE-2026-15036 entry.

Detection Methods for CVE-2026-15036

Indicators of Compromise

• Unexpected HTTP requests to the gitspaces list-all API endpoint from accounts with limited role assignments.
• Log entries showing a single authenticated principal enumerating spaces outside its normal project scope.
• Repeated calls to getAuthorizedSpaces-backed routes returning larger-than-expected result sets for low-privileged users.

Detection Strategies

• Enable verbose API access logging on Harness and correlate user identity with the space identifiers returned in list responses.
• Compare access patterns against the role-based access control (RBAC) matrix and flag principals reading spaces outside assigned projects.
• Alert on anomalous growth in the number of distinct spaces accessed per user over short time windows.

Monitoring Recommendations

• Forward Harness application and audit logs to a centralized SIEM for retention and correlation.
• Track authorization decisions and failed access attempts to build a baseline for gitspaces API usage.
• Review service accounts and API tokens with broad read scopes and reduce their permissions where feasible.

How to Mitigate CVE-2026-15036

Immediate Actions Required

• Inventory all Harness instances and identify deployments running versions at or below 2.28.2.
• Restrict network exposure of the Harness API to trusted networks or via VPN until a fix is applied.
• Audit existing user, service account, and token permissions and revoke unused or over-privileged credentials.
• Monitor the GitHub Issue #3689 and Harness release notes for an official patch.

Patch Information

At the time of publication, no vendor patch has been released. According to VulDB, the project was informed through an issue report but has not responded. Track the GitHub Harness Repository for new releases and apply security updates once available.

Workarounds

• Limit access to the Harness gitspaces API through a reverse proxy or web application firewall (WAF) rule set that enforces additional identity checks.
• Reduce the blast radius by scoping accounts to the minimum required spaces and disabling inactive users.
• Where feasible, restrict the gitspaces feature to trusted internal users until a fixed release is deployed.

# Example: block external access to the gitspaces list endpoint at an ingress proxy
# nginx snippet - allow only internal CIDR ranges to reach the vulnerable route
location ~ ^/api/v1/spaces/.*/gitspaces {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny  all;
    proxy_pass http://harness_backend;
}