Debusine manages Debian-based distributions through artifacts, where relationships between artifacts control build and distribution processes. The vulnerability lies in its endpoints for creating and deleting these relationships, which enforce no permission checks beyond the ability to view the artifacts involved. This flaw allows any user who can see artifacts to alter their relationships, potentially inserting malicious artifacts or disrupting the build pipeline, thereby harming the integrity and availability of the distribution.

Debusine, the Debian-based distribution management tool. The issue affects all versions that include unauthorized relationship endpoints before the corrective commit referenced in the Debian maintainers' repository.

The CVSS score is 6.5, indicating a medium severity, and the EPSS score is less than 1%, suggesting a low to moderate exploitation likelihood. Although no known exploits are listed in KEV, the lack of permission checks means that an attacker who has artifact visibility can manipulate relationships. The attack can be carried out via Debusine’s web or API endpoints, which is inferred from the exposed relationship endpoints. Overall, the risk is moderate until the issue is patched.