Cloud Foundry CAPI EUVD-2026-113756

The attacker must be able to reach the Cloud Controller public API listener over the network and must possess a valid build or droplet GUID; the described path to obtain one is the SpaceAuditor role, which can enumerate these GUIDs without write permissions. The exploitable surface is the /internal/v3/staging/:guid/droplet_completed and /build_completed callback endpoints, which are exposed because the Nginx routing configuration lacks the unauthenticated-access deny rule it applies to /internal/v4/ and /internal/v5/. LIMITING FACTORS: this is not fully anonymous - some authenticated/tenant access is needed to discover valid GUIDs, and the condition is the shipped Nginx routing config in cf-deployment versions before 60.7.0 and CAPI before v1.247.0; patched versions add the equivalent deny rule.

This is a genuine priority rather than an inflated CVSS score, though it stops short of emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity broken-access-control flaw: the public API listener for Cloud Controller serves /internal/v3/ staging callbacks because the Nginx config omits the deny rule it applies to /internal/v4/ and /internal/v5/, so the callbacks are reachable without OAuth or mutual TLS. The PR:L metric aligns with the described privilege-escalation path: a low-privilege SpaceAuditor can enumerate the build/droplet GUIDs that the attack needs, so the authentication barrier is effectively minimal for any tenant user. Signals are consistent where present and incomplete elsewhere: the vendor (VMware/Cloud Foundry) confirms the flaw and ships a patch, and the vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. However, EPSS is not provided, there is no CISA KEV listing (so no confirmed active exploitation), and no PoC or exploit reference is supplied - only the vendor advisory. No exploitation-probability data is therefore available to corroborate or temper the CVSS severity; risk should be driven by the confirmed access-control defect and the ease of GUID enumeration rather than by any observed exploitation.

A user holding a low-privilege SpaceAuditor role enumerates valid build or droplet GUIDs (which that role can read) and then sends a forged staging callback to /internal/v3/staging/:guid/droplet_completed or /build_completed on the public API listener, which accepts it without OAuth or mutual TLS. The droplet is transitioned to STAGED and arbitrary process metadata and sidecar data are persisted with no associated package or actor, escalating the auditor beyond its intended read-only boundary. No public exploit identified at time of analysis.