An incorrect privilege assignment flaw in Docker Hub’s account‑to‑organization conversion allows an authenticated attacker to reassign a personal access token they control to any other Docker Hub user, without changing or revoking the token’s secret. The attacker can then use the unchanged token to authenticate to the registry as the target user and perform pull, push or delete operations in the target’s accessible repositories, including organization repositories, within the token’s scopes.

Docker Hub accounts undergoing conversion from personal to organization type are affected. All users possessing personal access tokens that have been converted to organization accounts are at risk.

The CVSS score of 9.4 classifies this as a critical flaw. The vulnerability requires an attacker to be authenticated with a Docker Hub account and to trigger the account conversion process. Once abused, the attacker obtains the ability to act as the target user, potentially compromising sensitive container images. No EPSS or KEV data is presently available; nonetheless the high CVSS score indicates significant potential impact and the likelihood of exploitation should this logic remain unpatched.