CVE-2022-31683: Pivotal Software Concourse

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.

Affected products

• Pivotal Software Concourse: from 6.0.0, before 6.7.9 (fixed in 6.7.9); from 7.0.0, before 7.8.3 (fixed in 7.8.3)

Published 2022-12-19. Last modified 2026-06-17.