8.7
Élevée
CVE-2026-82882 Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint,…
Description
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| devtron 2.2 | premières → 2.2.0 | Pas de correctif indiqué |