CVE-2026-127076

OpsTree BuildPiper versions prior to 2.7.0 are susceptible to a broken access control vulnerability within the git_repo API. Authenticated users can exploit this by using the GET /api/v1/git_repo/?all=true endpoint to enumerate repositories restricted to other projects. By submitting an arbitrary...