CVE-2026-127076

OpsTree BuildPiper versions prior to 2.7.0 are susceptible to a broken access control vulnerability within the git_repo API. Authenticated users can exploit this by using the GET /api/v1/git_repo/?all=true endpoint to enumerate repositories restricted to other projects. By submitting an arbitrary...

EUVD-2026-125106

OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/gitrepo/?all=true and submit any gitrepoid to the ci endpoint,...