The anomaly allows an actor with push rights on the Reference State Log to forge a new log entry pointing to an older policy. Because the policy loader validates only that the referenced policy is signed by the current policy’s root keys, the attacker can effectively downgrade the active policy to an earlier state that may lack recent security enhancements or trust compromised root keys. This rollback enables the re‑introduction of legacy vulnerabilities and the removal of newer safeguards, constituting an instance of broken access control (CWE‑639).

The vulnerability affects the Git TUF (gittuf) platform used to enforce datastore integrity. All versions prior to 0.14.0 that rely on a git repository to host their Reference State Log are susceptible; any deployment that grants write access to that repository—especially in open‑source or collaborator‑heavy environments—matches the affected scenario.

With a CVSS score of 4.9 the flaw is rated low on the metrics of confidentiality, integrity, and availability, and the EPSS score is not available. It is not listed in CISA’s KEV catalog. Exploitation requires write access to the RSL, which is often limited to trusted users or administrators. In organizations where that permission is eased to general contributors, the attack vector becomes viable and could pave the way for more severe attacks when combined with other weaknesses.