The vulnerability in Juju versions 3.0.0 through 3.6.18 allows a user with permission to run the secret‑set tool to update any secret and to read or update other users’ secrets. When the tool logs an error, the secret is still updated and the new value is visible to both the original owner and the attacker, exposing confidential information and violating integrity. The flaw is a misimplementation of the authorization check identified as CWE–284, CWE–778, and CWE–863.

Affected systems are installations of Canonical Juju on Kubernetes clusters, specifically any Juju release between 3.0.0 and 3.6.18 inclusive. Users should verify their deployment version and plan to upgrade.

The CVSS score of 8.8 indicates high severity, and the EPSS score of below 1% suggests low current exploitation likelihood. The vulnerability is not listed in CISA KEV. The likely attack vector is an authenticated user or service account that has been granted secret‑set privileges; the mis‑authorization allows that actor to affect secrets beyond their intended scope.