The vulnerability resides in the customverbauthorizer admission plug‑in used by Gardener. In versions before 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the mustCheckProjectMembers manage‑members check only compares changes to User subjects and ignores Group or ServiceAccount subjects specified in Project.spec.members. As a result, a project administrator lacking manage‑members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated group, thereby granting that subject broad access to the project. This unauthorized access can encompass project resources such as Shoots, Secrets and cloud provider credentials. The weakness is an access control flaw (CWE‑863).

Gardener deployments running any version before 1.142.6, before 1.143.3, before 1.144.2, or before 1.145.0 are affected. Users of the gardener:gardener product should verify whether they are running a vulnerable release.

The CVSS score of 5.5 indicates a moderate severity. EPSS data is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack path requires an attacker to possess a project administrator role that does not have manage‑members permission and the ability to modify Project.spec.members. If successful, the attacker can inject a Group or ServiceAccount subject and create or elevate privileges within the project. No remote code execution or denial of service is implied, but the potential exposure of sensitive secrets and cloud credentials represents a significant confidentiality and integrity risk.