The weakness allows any authenticated user in Kite to request the /api/v1/overview endpoint for any cluster by supplying the x-cluster-name header. Because the route is registered before RBAC middleware and the handler merely checks that the user has at least one role, it returns aggregate Kubernetes inventory and capacity data from clusters that the user is not authorized to view. The result is disclosure of potentially sensitive cluster information and a violation of the principle of least privilege, mapped to CWE‑862.

Kite, the Kubernetes dashboard provided by kite‑org, is affected in all releases prior to v0.12.3. Users having any role—including those with minimal privileges—can exploit the flaw to access data from unauthorized clusters when running those older versions.

The CVSS score is 4.3, indicating moderate impact. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is authenticated: any logged‑in user can exploit the issue, so the exploit is trivial for legitimate users. There are no public exploits reported at this time, but because the flaw permits blanket data exposure across clusters, it poses a measurable risk in environments where users have broad role assignments.