CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...