Debusine CVE-2026-11852

The CVSS vector specifies PR:N (no privileges required), establishing a theoretical unauthenticated exploitation baseline; however, the description qualifies this: the only implicit prerequisite is the ability to 'see the artifacts in question.' If artifact visibility in a given deployment requires authentication, exploitation requires at minimum a read-level authenticated session - this is not confirmed from available data and must be verified per deployment configuration. The specific vulnerable functionality is the artifact relationship creation and deletion API endpoints within Debusine. No special non-default configuration is required beyond running an unpatched version (0.2.0 through 0.14.5). Exploitation is bounded by Debusine's niche deployment scope (Debian/Freexian build infrastructure) and the need for familiarity with the application's API. The absence of availability impact (A:N in CVSS) confirms that exploitation cannot cause service disruption, only unauthorized data manipulation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) scores 6.5 (Medium) and signals network-accessible exploitation at low complexity with no privileges or user interaction required. However, real-world risk is substantially tempered by multiple converging signals: EPSS places exploitation probability at just 0.01% (3rd percentile), indicating virtually no observed exploitation activity relative to the broader CVE population; the vulnerability is not listed in CISA KEV; and no public exploit code has been identified. Debusine's niche deployment scope - Debian build pipelines within the Freexian ecosystem - tightly limits the exposed attack surface. Both confidentiality and integrity impacts are rated Low, meaning an attacker cannot achieve full data exfiltration or complete repository compromise, only unauthorized manipulation of artifact relationships. Critically, the CVSS PR:N rating conflicts with the description's qualifier 'beyond being able to see the artifacts in question': if artifact visibility is restricted to authenticated users in a given deployment, effective exploitation requires at least read-level credentials, which reduces practical exploitability from the theoretical unauthenticated baseline. This ambiguity should be verified per deployment. Overall, this is a genuine but low-urgency issue given the narrow deployment footprint and low exploitation signals.

A remote actor who can view artifacts in a Debusine instance - at minimum with read-level access, or potentially without authentication if artifacts are publicly visible - sends crafted API requests to the artifact relationship creation or deletion endpoints. Because no write-permission check is enforced, the requests succeed, allowing the attacker to arbitrarily restructure the artifact relationship graph, potentially corrupting build pipeline metadata or causing incorrect artifact associations. No public exploit code exists, and exploiting this flaw requires knowledge of Debusine's internal API structure and artifact identifiers.