In Goploy releases 1.17.5 and earlier, several project file handlers accept a row identifier supplied in the JSON body and perform file operations without verifying that the requested row belongs to the caller’s namespace. A privileged user with the Manager role or any role granting FileSync / EditProject permissions can read, write, delete, or overwrite files in any project across the entire installation. By altering a project's remote git URL through the same interface, the attacker triggers a ‘git remote set-url’ command during the next deployment, allowing arbitrary code execution on the deployment host. This vulnerability is a classic IDOR (CWE-639) that also results in sensitive data exposure (CWE-863).

The product affected is Goploy, maintained by the zhenorzz project, in all versions up to and including 1.17.5. Users with elevated namespace permissions who can invoke the Project.AddFile, Project.EditFile, Project.RemoveFile, or Project.Edit handlers are at risk.

The CVSS score of 9.6 marks the flaw as critical. Although no EPSS score is available, the complexity of the exploit is low for anyone with the requisite role, and the impact is global across the installation. The vulnerability is not listed in CISA’s KEV catalog, but its RCE potential and the breadth of access it grants make it a high‑risk vector should an attacker acquire the necessary permissions.