Calico’s apiserver is designed to enforce tier‑scoped authorization on every operation through the AuthorizeTierOperation hook. However, the Delete override on NetworkPolicy and GlobalNetworkPolicy resources is not executed for DeleteCollection requests. As a result, a user who is granted the deletecollection verb—or a wildcard verb encompassing tier‑scoped policy resources—can bypass the intended tier boundary and remove policies from tiers on which they have no rights. This unauthorized deletion destroys the network segmentation that the policies enforce, exposing containers or hosts to traffic that should have been blocked. The weakness is an authority escalation flaw described by CWE‑285 and CWE‑863. The compromise can lead to a systemic loss of network security controls and, if combined with other attacks, may facilitate lateral movement or data exfiltration.

The vulnerability affects Tigera products: Calico, Calico Cloud, and Calico Enterprise. No specific version range is provided in the data, so any deployment that implements the tier authority checks in the apiserver is potentially impacted.

The CVSS score of 6.2 indicates moderate severity, and the EPSS score of 0.00272 (below 1%) indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred: an authenticated user with the deletecollection permission (or a wildcard verb covering tier‑scoped policy resources) can trigger the bypass. Exploitation requires only that the attacker have the said permission; no additional conditions are mentioned in the description.