The vulnerability arises from Debusine's artifact relationship endpoints lacking proper permission checks. Any user who can view artifacts can also create or delete relationships. This enables an attacker to manipulate the build pipeline, potentially insert malicious artifacts or break distribution integrity, compromising both confidentiality and availability of the Debian‑based distribution.

Debusine, the Debian‑based distribution management tool. The issue applies to all versions that implement artifact relationship endpoints before the patch referenced in the Debian commit 98104f46dc546a27a0326d5ef728ac7f426c430a.

The CVSS score is not provided, and EPSS is unavailable, so the exact exploitation likelihood is unclear. However, because any actor who can view artifacts can manipulate relationships, the risk is moderate to high until mitigated. No KEV listing indicates no known exploited cases to date. The attack requires only discovery of artifact visibility; once that is achieved, the relationship endpoints can be abused.