---
id: CVE-2026-121734
title: >-
  ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via
  ReviewPreviewEnvDeployAPIView
summary: >-
  ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability
  that allows any workspace administrator to read another workspace's pending
  preview environment by querying ReviewPreviewEnvDeployAPIView without project
  scoping…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: zane-ops
product: zane-ops
affected:
  - zane-ops >= 1.14.0 < 1.15.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-07T03:38:13.932833Z'
exploitAvailable: true
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:38:38.316Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121734'
references:
  - url: >-
      https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494
    label: Patch Commit
  - url: 'https://github.com/zane-ops/zane-ops'
  - url: >-
      https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q
    label: GitHub Security Advisory (GHSA-r87v-8542-wx9q)
  - url: >-
      https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248
  - url: 'https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2'
    label: ZaneOps v1.15.2 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview
    label: >-
      VulnCheck Advisory: ZaneOps 1.14.0 before 1.15.2 Cross-Workspace
      Information Disclosure via ReviewPreviewEnvDeployAPIView
tags:
  - cve.org
  - exploit-available
epss: 0.00276
epssPercentile: 0.20133
ingestedAt: '2026-11-05T20:33:06.611Z'
---

## Overview

ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.

## Affected

- `zane-ops >= 1.14.0 < 1.15.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.