CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, "nora-registry" authenticates the token-management UI but fails to require administrator authorization. "authmiddleware" protects "/ui/tokens" and "/api/ui/tokens", but state-changing requests are checked only with...