EUVD-2026-48612
GHSA-87fc-9c43-8q4g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.
AnalysisAI
Unauthenticated attackers can overwrite operator metadata including email and company name in lakeFS versions through 1.83.0 via the /setup_comm_prefs endpoint, potentially disabling security communications and manipulating telemetry. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV.
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not
Stored cross-site scripting in lakeFS Web UI allows an authenticated contributor to execute arbitrary JavaScript in any
Authenticated users in lakeFS prior to version 1.77.0 can exploit path traversal vulnerabilities in the local block adap
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today