CVE-2020-5418: Cloudfoundry Capi-Release

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).

Affected products

• Cloudfoundry Capi-Release: before 1.98.0 (fixed in 1.98.0)
• Cloudfoundry Cf-Deployment: before 13.17.0 (fixed in 13.17.0)

Published 2020-09-03. Last modified 2026-06-17.