Docker Hub
Monthly
Incorrect privilege assignment in Docker Hub's account-to-organization conversion feature lets an authenticated user bind a personal access token they control to a different Docker Hub account without the token secret ever being rotated or revoked. The unchanged PAT then continues to authenticate successfully - now as the recipient user - granting pull, push, and delete operations, within its existing scopes, across every repository that user can access, including organization repositories. Docker rates this 9.4 under CVSS 4.0 and our independent assessment characterizes it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, but exploitation is not unauthenticated: the attacker must already hold a valid Docker Hub account and a PAT, and the damage is bounded by that token's scopes; no public exploit code has been identified at time of analysis.
Incorrect privilege assignment in Docker Hub's account-to-organization conversion feature lets an authenticated user bind a personal access token they control to a different Docker Hub account without the token secret ever being rotated or revoked. The unchanged PAT then continues to authenticate successfully - now as the recipient user - granting pull, push, and delete operations, within its existing scopes, across every repository that user can access, including organization repositories. Docker rates this 9.4 under CVSS 4.0 and our independent assessment characterizes it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, but exploitation is not unauthenticated: the attacker must already hold a valid Docker Hub account and a PAT, and the damage is bounded by that token's scopes; no public exploit code has been identified at time of analysis.