The vulnerability allows any authenticated user to access the /orchestrator/api-token/webhook endpoint without proper authorization checks. When a request supplies arbitrary project, environment, and application parameters, the system returns a plaintext super‑admin JWT token. Possession of such a token grants the attacker full administrative control over the entire Devtron platform, enabling actions that affect confidentiality, integrity, and availability. This defect is a missing authorization flaw (CWE‑862).

Devtron version 2.2.0 and all earlier releases from the vendor devtron‑labs are vulnerable. Users running these or earlier releases are exposed because the endpoint returns admin API tokens without enforcing access control.

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS is not available in the current data, and the issue is not listed in the CISA KEV catalog. Attackers only need an authenticated account to exploit this flaw, a condition that is likely present in any deployed instance. The lack of authorization controls makes the attack path straightforward, and obtaining the super‑admin token can lead to irreversible platform compromise.