CVE-2026-78360

A missing authorization flaw was found in Anitya. The user deletion endpoint checks that the caller is logged in but does not check that the caller is an administrator. Any authenticated user can delete arbitrary user accounts, including administrator accounts, which can remove administrative...

Missing Authorization

Overview anitya is an A cross-distribution upstream release monitoring project Affected versions of this package are vulnerable to Missing Authorization via the deleteuser process. An attacker can remove arbitrary user accounts, including those with administrative privileges, by sending crafted...