A flaw in the Red Hat Quay 3 API allows an authenticated administrator to retrieve, modify, or delete build triggers of another repository by providing the trigger’s UUID. The vulnerability stems from a missing ownership check, enabling an IDOR that exposes the associated write tokens and confers full manipulation rights over the victim repository. This effectively grants the attacker control over the victim repository’s build triggers and tokens.

The issue affects Red Hat Quay version 3, which is deployed by Red Hat as part of the Quay Container Registry solution.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not widely exploited yet. Nonetheless, the flaw requires authenticated administrative privileges and could be abused by anyone who gains repository‑level admin access. The attack vector is the Quay API; the vulnerability does not require network compromise or local execution, so the impact is confined to repositories controlled by the attacker.