CVE-2026-53552

Goploy 1.17.5 and prior contains an authorization flaw (CWE-639, CWE-863) in the Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit handlers in cmd/server/api/project/handler.go, which accept a project or project-file row ID from the JSON body and act on it without verifying that the project belongs to the caller's namespace; the underlying model.ProjectFile.GetData and model.Project.GetData queries filter only by row ID. A user holding the manager role, or any role that includes the FileSync or EditProject permission, triggers the flaw by submitting another project's or file's ID in the request body. This lets them read, write, or delete files in any project across the installation and rewrite any project's git remote URL, and because Edit runs git remote set-url on the project's working tree, an attacker-controlled remote URL escalates to remote code execution on the next deploy. Any Goploy deployment running version 1.17.5 or earlier is affected, including multi-namespace installations where ordinary users can reach projects outside their own namespace. As of publication there is no public PoC, the issue is not in CISA KEV, EPSS is 0.2% (10th percentile), and no patch has been released.

What to do: No fixed version is available yet, so upgrade as soon as a release beyond 1.17.5 is published and monitor the project's security advisories. In the meantime, restrict Goploy access to trusted users, minimize accounts holding FileSync or EditProject permissions, and audit each project's git remote URL (e.g., git remote -v in each working tree) for unexpected changes, since a tampered remote is the path to RCE on the next deploy.