CVE-2026-48089: DevGuard Auth Bypass Vulnerability

CVE-2026-48089 Overview

CVE-2026-48089 is a broken access control vulnerability [CWE-285] in DevGuard, an open-source vulnerability management platform for the software supply chain. Versions prior to 1.4.2 expose write endpoints on public assets to any authenticated user, regardless of organization membership. Attackers with a valid account on the instance can create, update, reapply, and delete VEX rules on public assets belonging to other organizations. The flaw also extends to dependency-vuln event creation, batch event creation, vulnerability sync, mitigation, license risk creation, external reference writes, and artifact creation.

Critical Impact
Any authenticated user on a DevGuard instance can tamper with vulnerability triage data, VEX rules, and artifacts on public assets owned by other organizations, undermining the integrity of supply chain risk decisions.

Affected Products

DevGuard versions prior to 1.4.2
DevGuard API instances exposing one or more public assets
Downstream consumers of public vex.json and sbom.json endpoints

Discovery Timeline

2026-06-19 - CVE-2026-48089 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48089

Vulnerability Analysis

DevGuard exposes a public-read exemption in its access-control middleware to allow unauthenticated consumption of artifacts such as vex.json and sbom.json on public assets. The middleware fails to differentiate between read and write operations under that exemption. As a result, the same public-asset path treats authenticated write requests as authorized, even when the requester has no role in the target organization, project, or asset.

The affected write endpoints span the full vulnerability-triage surface, including VEX rule lifecycle operations (create, update, reapply, delete), dependency-vuln event decisions (accept, reject, mitigate), batch event creation, vulnerability sync and mitigation, license risk creation, external reference writes, and artifact creation with license refresh. An attacker can use this access to forge VEX exemptions that mask real vulnerabilities or inject false findings into a victim organization's triage workflow.

Root Cause

The root cause is improper authorization [CWE-285] in the access-control middleware. The public-asset exemption bypasses role-based access control (RBAC) checks for any request authenticated against the instance. There is no enforcement that the write endpoints require asset-scoped RBAC verification before mutating state.

Attack Vector

Exploitation is performed over the network by an authenticated user. The attacker registers or uses any valid account on the DevGuard instance and issues authenticated requests to write endpoints on a target organization's public asset. No project membership, role assignment, or social engineering is required.

// Patch from middlewares/access_control_middlewares.go
func DisallowPublicRequests(next echo.HandlerFunc) echo.HandlerFunc {
    return func(ctx shared.Context) error {
        if shared.IsPublicRequest(ctx) {
            slog.Warn("access denied for public request in DisallowPublicRequests middleware")
            return echo.NewHTTPError(404, "could not find resource")
        }
        return next(ctx)
    }
}

Source: GitHub Commit 1be88ec

The patch introduces DisallowPublicRequests middleware and applies AssetAccessControlFactory on routers such as artifact_router.go so that write endpoints under public assets enforce asset-scoped RBAC rather than inheriting the public-read exemption.

Detection Methods for CVE-2026-48089

Indicators of Compromise

Unexpected VEX rule create, update, reapply, or delete operations on public assets from accounts outside the asset's organization.
Dependency-vuln event decisions (accept, reject, mitigate) attributed to users with no role in the target project.
Sudden artifact creation or license refresh events on public assets initiated by external accounts.
Modifications to external references or license risk entries that do not match approved triage workflows.

Detection Strategies

Audit DevGuard application logs for write operations on public assets where the authenticated user lacks membership in the owning organization.
Correlate VEX rule and dependency-vuln event mutations against the expected reviewer roster for each project.
Compare current vex.json and sbom.json exports against trusted baselines to identify unauthorized state changes.

Monitoring Recommendations

Enable verbose request logging on the DevGuard API and forward to a centralized log platform for retention and search.
Alert on high-frequency write operations against public assets originating from new or low-reputation accounts.
Track artifact creation, license refresh, and external reference writes as security-relevant events with reviewer attribution.

How to Mitigate CVE-2026-48089

Immediate Actions Required

Upgrade DevGuard to version 1.4.2 or later, which contains the access-control middleware fix.
Until patched, switch affected assets from public to private in the asset settings to remove the public-read exemption.
Review recent VEX rule, dependency-vuln event, artifact, and license risk changes for unauthorized mutations and revert as needed.
Audit the instance's authenticated user base and remove dormant or untrusted accounts.

Patch Information

Version v1.4.2 contains the patch. The fix adds the DisallowPublicRequests middleware in middlewares/access_control_middlewares.go and applies AssetAccessControlFactory to routers such as router/artifact_router.go. Details are available in the GitHub Security Advisory GHSA-6p54-fw2f-q7gf and the GitHub Commit Details.

Workarounds

Set affected assets to private visibility in the DevGuard asset settings to restore RBAC enforcement on write endpoints.
Grant explicit access to downstream consumers that previously relied on public vex.json or sbom.json endpoints.
Distribute exported file versions of vex.json and sbom.json to downstream consumers until the patched release is deployed.

bash

# Verify DevGuard version and upgrade
devguard version
# Upgrade to patched release
git fetch --tags && git checkout v1.4.2