Nuclio’s serverless dashboard contains a missing authorization check on its project write endpoints. Any authenticated user who is not a member of a target project can issue PUT /api/projects/{id} or DELETE /api/projects requests and change or remove that project and all associated functions and gateways, effectively taking control of or destroying an entire project’s resources. The vulnerability is a classic missing authorization flaw (CWE‑862) that can expose sensitive data, disrupt services, and compromise the integrity of the platform.

The issue affects the Nuclio software distributed under the nuclio:nuclio product family. All installations running Nuclio Dashboard before version 1.16.0 are vulnerable; version 1.16.0 and later contain a fix that restores proper OPA authorization checks on write paths.

With a CVSS score of 8.3 the flaw is classified as high severity. An attacker only needs valid credentials and does not require any special privileges or system access, which makes exploitation straightforward. Although an EPSS score is not available, the CVE is not listed in the CISA KEV catalog, but the presence of a wide range of authenticated operations that bypass authorization elevates the risk and suggests that exploitation is likely if an attacker gains access to any user account.