A flaw in OpenChoreo’s workflow run update endpoint permits an authenticated user who has workflowrun:update permissions for a different project or component within the same namespace to overwrite the ownership labels of another user’s workflow run. This enables the attacker to claim the run, view its logs and Kubernetes events, delete the run, alter its pending workflow parameters, or force a permanent failure state. The vulnerability arises from the authorization check using the request body labels while the target run is identified by its URL path, creating a privilege escalation pathway. This corresponds to a typical Authorization Bypass weakness (CWE‑639).

OpenChoreo platform versions 1.0.0 through 1.0.6, 1.1.7, and 1.2.5 are affected. The issue is confined to operations within a single Kubernetes namespace; it does not allow anonymous access or cross‑tenant escalation.

With a CVSS score of 7.4, the vulnerability is considered High severity. The EPSS score is not available, but because the exploit requires only an authenticated user with limited permissions and the same namespace context, the likelihood of exploitation remains significant in environments where RBAC is misconfigured. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known. The attacker can compromise confidentiality, integrity, and availability of workflow runs across projects within a namespace, making the risk substantial for users who grant broad update rights.