Harbor fails to validate the user permissions when updating tag immutability policies

Harbor, an open-source cloud native registry, fails to validate user permissions when updating tag immutability policies. The vulnerability exists in the API endpoint PUT /projects/{project_name_or_id}/immutabletagrules/{immutable_rule_id}, which does not check whether the authenticated user has access to the project associated with the immutable rule ID [1][3].

An attacker with any valid user account can exploit this by sending a request to update a tag immutability policy using an immutable_rule_id that belongs to a project they do not have access to. The server processes the request without verifying permissions, allowing the attacker to modify policies in arbitrary projects [1][3].

The impact is that an attacker can alter tag immutability policies in other projects, potentially bypassing retention controls and compromising the integrity of image management. This could lead to unauthorized changes in which tags are protected or allowed to be overwritten [1][3].

This issue is fixed in Harbor v2.5.2 and later. Users should upgrade to the latest version as soon as possible, as no workarounds are available [3].