A flaw in the getAuthorizedSpaces function of Harness gitspaces Endpoint allows an attacker to bypass authorization checks. The flaw permits remote execution, as the function can be manipulated without proper authentication, leading to unauthorized access to space listings. The vulnerability is an example of insufficient authorization (CWE-285) combined with a logic flaw that trusts client input (CWE-639).

The software affected is Harness up to version 2.28.2. Systems running any of those releases host the vulnerable gitspaces API module and can be exposed to the broader internet if the endpoint is reachable remotely.

The The CVSS score of 5.3 and the EPSS score of < 1% suggest a moderate severity with low likely exploitation rate. No known exploited variants are listed in the CISA KEV catalog, yet the public disclosure and the clear that an attacker could feasibly craft a request that fools Harness and obtains unauthorized space listings. The best‑practice approach is to treat this as a potential privilege escalation vector and act accordingly.