{"id":"CVE-2026-128037","summary":"gittuf: Policy rules bypassed in the presence of global rules","details":"In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, verification gives the global rule's check over all trusted users in the policy precedence over the policy rule's own authorized users. A user listed in the policy file but not authorized by the policy rule, or fewer users than the rule's threshold, can make changes to the protected namespace that pass verification.","aliases":["GHSA-qc8j-pcph-6q9x"],"modified":"2026-11-14T02:47:04.743831353Z","published":"2026-11-13T15:20:38.824Z","database_specific":{"cna_assigner":"Akrites","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128037.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128037.json"},{"type":"PACKAGE","url":"https://github.com/gittuf/gittuf"},{"type":"WEB","url":"https://github.com/gittuf/gittuf/releases/tag/v0.16.0"},{"type":"ADVISORY","url":"https://github.com/gittuf/gittuf/security/advisories/GHSA-qc8j-pcph-6q9x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128037"},{"type":"WEB","url":"https://pkg.go.dev"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gittuf/gittuf","events":[{"introduced":"fe159a3ac5f5c4fe2ac6f2aa40a5b8a7b5fb5cf6"},{"fixed":"fa3c295e1e46c1cff10aec1194edc29f19677723"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0.10.0"},{"fixed":"0.16.0"}],"source":"AFFECTED_FIELD"},{"original_tag":"v0.16.0","range":[{"fixed":"fa3c295e1e46c1cff10aec1194edc29f19677723"}],"source":"REFERENCES_TAG"}]}}],"versions":["v0.15.0","v0.14.1","v0.14.0","v0.13.1","v0.13.0","v0.12.0","v0.11.0","v0.10.2","v0.10.1","v0.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128037.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}