Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
Date: 2026-06
Affected: go/github.com/nuclio/nuclio
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-45730
CWE: CWE-862
CVSS: 8.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)

This vulnerability exists in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (`PUT /api/projects/{id}`, `DELETE /api/projects`) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). CWE classification: CWE-862 (Missing Authorization). --- ## Summary Nuclio Dashboard correctly enforces OPA-based authorization on the project read path (`GET /api/projects`), populating `MemberIds` in `PermissionOptions` so OPA can filter results by user membership. However, the write paths (`PUT /api/projects/{id}` and `DELETE /api/projects`) construct `PermissionOptions` without setting `MemberIds`. The platform-layer `FilterProjectsByPermissions` function (`pkg/platform/abstract/platform.go:652`) short-circuits when `MemberIds` is empty, bypassing OPA entirely. Any authenticated user who knows a project name can modify or delete that project, triggering cascading deletion of all associated Functions, APIGateways, and FunctionEvents. Affected: Nuclio v1.15.26 (latest Helm release) and HEAD commit e185454 (latest source). --- ## Attacker Model **Attacker type**: Authenticated low-privilege tenant (no membership in the target project) **Initial access**: - Holds any valid Nuclio Dashboard credentials - The account has no membership in the target project (OPA correctly denies `GET /api/projects`, returning an empty list)


Mitigations:

Architectural layers (MAESTRO):