The vulnerability stems from a misconfigured Nginx routing rule that allows unauthenticated access to /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed endpoints. Because no deny rule exists for /internal/v3/, an attacker who discovers a valid build or droplet GUID can send forged staging callbacks to the public API listener bypassing OAuth or mutual TLS. The attacker can then transition a droplet to STAGED and write arbitrary process metadata and sidecar data without having a package or actor, effectively creating or modifying resources that the acting party is not authorized to control. A user with the SpaceAuditor role can enumerate GUIDs that lack write permissions, giving the attacker a privilege escalation path beyond the intended role boundaries. This constitutes an access control weakness allowing unauthenticated users to perform authenticated‑level actions.

The affected products are Cloud Foundry’s Cloud Controller API (CAPI) and deployments configured with the default cf-deployment Nginx routing set. The vulnerability exists in any release that contains the routing configuration described; no specific patch version is listed in the advisory. Administrators should verify whether their environment uses the vulnerable Nginx rule and apply the latest release that provides a fix or add a corrective deny rule to the configuration.

The CVSS score of 8.8 describes high severity. The EPSS score is not available, but due to the lack of authentication and the fact the exposed endpoints are reachable from the public API listener, an attacker can exploit the flaw remotely from the internet once a valid GUID is known. The vulnerability is not currently listed in the CISA KEV catalog, yet its remote exploitation surface and the potential for privilege escalation make it a high priority for remediation.