CVE-2019-3785: Cloudfoundry Capi-Release

High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days.

Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.

Affected products

• Cloudfoundry Capi-Release: before 1.78.0 (fixed in 1.78.0)

Published 2019-03-13. Last modified 2026-06-17.