CVE-2026-127078

OpsTree BuildPiper versions prior to 2.7.0 are vulnerable to an authorization bypass via the project_env_id parameter. This flaw allows authenticated users to attach another application's environment to their own service by providing a foreign project_env_id. By exploiting this, an attacker can a...