NORA Registry CVE-2026-59164

Requires the registry to have auth enabled and the token-management endpoints (/ui/tokens, /api/ui/tokens) reachable over the network. For metadata disclosure, the attacker needs any valid read-scoped bearer token (PR:L); for the destructive path, the attacker needs a valid write-scoped bearer token or a write-capable OIDC workload identity, which can then revoke arbitrary cross-user admin and service tokens using IDs exposed by the global list. Limiting factors: read-only identities cannot POST the revocation (they are confined to enumeration), exploitation presupposes the attacker already holds at least a valid write credential rather than being fully unauthenticated, and impact is greatest only on multi-identity deployments that hand write-scoped credentials to semi-trusted CI/OIDC workloads. There is also a related policy concern in the body-authenticated POST /api/tokens route where an htpasswd account could request role:admin, addressed in 0.9.5 via the new auth.admin_users allowlist.

Signals are moderate and broadly consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1 High) describes a network-reachable, low-complexity flaw requiring low privileges and no user interaction - the PR:L is the key qualifier, since exploitation of the destructive path requires the attacker to already hold a valid write-scoped bearer token or write-capable OIDC identity, not an anonymous attacker. The vuln.today decision label is this_week (not act_now/emergency), which fits a credentialed broken-access-control issue rather than a remote-unauthenticated RCE. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of active exploitation or a modeled exploitation probability; absence of these is not evidence of safety but should not be read as active exploitation. The GHSA advisory includes a reproduction (curl commands), but the reporter explicitly states they found it in source and did not test a deployed instance, so this is a public PoC reference, not verified working exploit code. Net: a real but scoped priority - most dangerous for instances that issue write-scoped CI/OIDC credentials to semi-trusted workloads, where any such credential can revoke admin and service tokens across all users. The I:H rating reflects that destructive cross-user revocation (credential-state tampering) rather than classic data integrity; read-only credentials are limited to metadata disclosure (C:L).

A CI pipeline or OIDC workload holding only a write-scoped bearer token for pushing artifacts calls GET /api/ui/tokens/list and harvests the 16-character file IDs, owners, and roles of every token on the registry, including admin and service tokens. The attacker then POSTs /api/ui/tokens/<id>/revoke against those IDs, revoking unrelated administrators' and services' credentials and disrupting the registry until operators perform credential recovery. A public PoC reference exists (curl commands in the GHSA advisory); it is not verified as working exploit code.