CVE-2026-61833

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61833
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61833.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61833
Aliases
Downstream
Published
2026-09-18T16:55:22Z
Modified
2026-09-20T11:46:55Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Details

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61833.json"
}
References

Affected packages

Git / github.com/project-zot/zot

Affected ranges

Type
GIT
Repo
https://github.com/project-zot/zot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7bb211bcd4352b90f3e99752607fbd1f050bf7ca
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.18"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.3.0
v0.*
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.1
v0.3.10
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.8-rc2
v1.3.8-rc3
v1.3.9
v1.4.0
v1.4.0-rc1
v1.4.0-rc2
v1.4.0-rc3
v1.4.0-rc4
v1.4.1
v1.4.1-rc1
v1.4.1-rc2
v1.4.1-rc3
v1.4.1-rc4
v1.4.1-rc5
v1.4.1-rc6
v1.4.2
v1.4.2-rc1
v1.4.2-rc2
v1.4.2-rc3
v1.4.2-rc4
v1.4.2-rc5
v1.4.2-rc6
v1.4.3
v1.4.3-rc1
v1.4.3-rc2
v1.4.3-rc3
v1.4.3-rc4
v1.4.3-rc5
v1.4.3-rc6
v1.4.3-rc7
v1.4.3-rc8
v1.4.3-rc9
v2.*
v2.0.0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.0.0-rc4
v2.0.0-rc5
v2.0.0-rc6
v2.0.0-rc7
v2.0.0-rc8
v2.0.1
v2.0.1-rc1
v2.0.1-rc2
v2.0.2
v2.0.2-rc1
v2.0.2-rc2
v2.0.2-rc3
v2.0.3
v2.0.4
v2.1.0
v2.1.0-rc1
v2.1.0-rc2
v2.1.1
v2.1.10
v2.1.11
v2.1.12
v2.1.13
v2.1.14
v2.1.15
v2.1.16
v2.1.17
v2.1.2
v2.1.2-rc1
v2.1.2-rc2
v2.1.2-rc3
v2.1.2-rc4
v2.1.2-rc5
v2.1.3
v2.1.3-rc1
v2.1.3-rc2
v2.1.3-rc3
v2.1.3-rc4
v2.1.3-rc5
v2.1.3-rc6
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61833.json"