CVE-2024-22278
Harbor fails to validate the user permissions when updating project configurations
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Harbor fails to validate the user permissions when updating project configurations
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
- Record
CVE-2024-22278- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
EUVDEUVD-2024-2366
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
- Record
EUVD-2024-2366- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hw28-333w-qxp3
Harbor fails to validate the user permissions when updating project configurations
Impact
Harbor fails to validate the maintainer role permissions when creating/updating/deleting project configurations - API call:
- PUT /projects/{project_name_or_id}/metadatas/{meta_name}
- POST /projects/{project_name_or_id}/metadatas/{meta_name}
- DELETE /projects/{project_name_or_id}/metadatas/{meta_name}
By sending a request to create/update/delete a metadata with an name that belongs to a project that the currently authenticated and granted to the maintainer role user doesn’t have access to, the attacker could modify configurations in the current project.
BTW: the maintainer role in Harbor was intended for individuals who closely support the project admin in maintaining the project but lack configuration management permissions. However, the maintainer role can utilize the metadata API to circumvent this limitation. It's important to note that any potential attacker must be authenticated and granted a specific project maintainer role to modify configurations, limiting their scope to only that project.
Patches
Will be fixed in v2.9.5, v2.10.3 and v2.11.0
Workarounds
There are no workarounds available.
Credit
Thanks to Ravid Mazon([email protected]), Jay Chen ([email protected]) Palo Alto Networks for reporting this issue.
- Record
GHSA-hw28-333w-qxp3- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-269
- Updated
- 2026-11-02
NVD
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
- Record
CVE-2024-22278- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-269
- Updated
- 2026-11-02
OSV
Harbor fails to validate the user permissions when updating project configurations
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
- Record
CVE-2024-22278- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVGHSA-hw28-333w-qxp3
Harbor fails to validate the user permissions when updating project configurations
Impact
Harbor fails to validate the maintainer role permissions when creating/updating/deleting project configurations - API call:
- PUT /projects/{project_name_or_id}/metadatas/{meta_name}
- POST /projects/{project_name_or_id}/metadatas/{meta_name}
- DELETE /projects/{project_name_or_id}/metadatas/{meta_name}
By sending a request to create/update/delete a metadata with an name that belongs to a project that the currently authenticated and granted to the maintainer role user doesn’t have access to, the attacker could modify configurations in the current project.
BTW: the maintainer role in Harbor was intended for individuals who closely support the project admin in maintaining the project but lack configuration management permissions. However, the maintainer role can utilize the metadata API to circumvent this limitation. It's important to note that any potential attacker must be authenticated and granted a specific project maintainer role to modify configurations, limiting their scope to only that project.
Patches
Will be fixed in v2.9.5, v2.10.3 and v2.11.0
Workarounds
There are no workarounds available.
Credit
Thanks to Ravid Mazon([email protected]), Jay Chen ([email protected]) Palo Alto Networks for reporting this issue.
- Record
GHSA-hw28-333w-qxp3- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVBIT-harbor-2024-22278 No score
Harbor fails to validate the user permissions when updating project configurations
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
- Record
BIT-harbor-2024-22278- Updated
- 2026-11-02
OSVGO-2024-3013 No score
Harbor fails to validate the user permissions when updating project configurations in github.com/goharbor/harbor
Harbor fails to validate the user permissions when updating project configurations in github.com/goharbor/harbor
- Record
GO-2024-3013- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/goharbor/harborGo |
before 2.9.5 | 2.9.5 |
github.com/goharbor/harborGo |
2.10.0 up to 2.10.3 | 2.10.3 |
harborBitnami |
before 2.11.0 | 2.11.0 |
github.com/goharbor/harborGo |
before 2.9.5+incompatible, 2.10.0+incompatible up to 2.10.3+incompatible | 2.9.5+incompatible2.10.3+incompatible |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-22278 is a medium vulnerability (CVSS 6.4) in Harbor, published July 31, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in github.com/goharbor/harbor 2.9.5.