CVE-2026-18375

The checkapiacls function in Pagure's API returns immediately without performing any ACL validation when the requesting user has an active browser session. API endpoints protected by @apiloginrequired, including the project creation endpoint POST /api/0/new and a range of repository management...