Cube Core is vulnerable to privilege escalation via a specially crafted request
Impact It is possible to make a specially crafted request with a valid API token that leads to privilege escalation. Affected Versions: ≥= 0.27.19 Mitigation: Upgrade to a patched version: 1.5.13 and later (regular release) 1.4.2 (active LTS release) 1.0.14 (end-of-life LTS release) References The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.