VMware Aria Automation (missing access control): An authenticated user reaches remote organizations and workflows they

Impact

An authenticated user reaches remote organizations and workflows they should not see - a tenancy-boundary failure inside the automation platform, with scope change.

Who can reach it

Any authenticated Aria Automation user.

What to do

Apply the fix per VMSA-2024-0001. Appliance patch; review org/workflow assignments afterwards for signs of cross-org access.

References

Related entries

• Cisco Nexus Dashboard Fabric Controller (REST API / web UI): A low-privileged NDFC userCVE-2024-20432 · Cisco Nexus Dashboard Fabric Controller (REST API / web UI)Critical
• Zabbix: SQL injection in CUser::addRelatedObjects reachable by ANY non-admin account with API accessCVE-2024-42327 · ZabbixCritical
• Grafana: SQL Expressions passes user input to duckdb unsanitizedCVE-2024-9264 · GrafanaCritical
• Redis: "RediShell" - authenticated user crafts a Lua script to trigger a use-after-freeCVE-2025-49844 · RedisCritical
• Logging operator: unescaped Flow CRD values inject Fluentd directives and run commands in the aggregatorCVE-2026-54680 · Logging operator (Fluentd config renderer, pkg/sdk/logging/model/render/fluent.go)Critical
• Prowler: legacy gcp auth-provider in kubeconfig runs commands on the shared scan workerCVE-2026-73263 · Prowler API (Kubernetes provider connection test, kubeconfig exec-auth validation)Critical