CVE-2026-103504

Summary

A team's permission level was not properly enforced after API updates, allowing members to retain higher-level access than granted. This creates a privilege escalation risk where users maintain write permissions beyond their assigned team role.

Exploitability

Exploitation requires an authenticated user with team management privileges and is moderately difficult, needing API calls to modify team permissions while maintaining existing unit access.

Blast radius

The vulnerability affects all organizations using the API for team permission changes, potentially allowing unauthorized write access to repositories and data within units where team members were demoted.

Detection

Monitor for API calls to team permission endpoints with permission field updates, specifically looking for requests that modify team roles without rebuilding unit access permissions.

Prioritized remediation

Upgrade to version 2.590 or later to receive the patch that properly enforces team permission changes and rebuilds per-unit access.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.