CVE-2026-63727

CVE-2026-63727 allows a read-only user in Anchore Enterprise to escalate to write access through the user management API with a single call. The advisory explicitly notes that the system-admin role cannot be granted through this path—a constraint that tells you everything about how incomplete the original threat modeling was. Someone worried enough to block the dramatic escalation (system-admin) left the incremental one (read-to-write) unguarded. That's not a security boundary; it's a happy-path assumption dressed as a permission model. The EPSS score of 0.00226 reflects current wild conditions, which for Anchore means internal-facing deployments and relatively small attack surface. But the exploitation barrier here is trivial once you have read-only access—a single API call, no recon required. The real question isn't whether the exploit works; it's how many read-only credentials are already compromised or trivially obtainable. Treat this as a supply chain vulnerability, not a permission bug. Anchore Enterprise generates the security verdicts that downstream CI/CD pipelines trust. Write access means approving image analyses, modifying vulnerability policies, and marking containers as compliant. Compromising a read-only credential, escalating via this API, and then touching the assessment pipeline is a supply chain attack that never touches a container directly. Your build process trusts Anchore's output; an attacker corrupts that trust at the source. Prioritize: audit every service account, CI/CD integration, and automation bot with read-only access—these are the most likely initial access vectors, and they're typically long-lived with poor rotation hygiene. Patch to 5.27.2 or 6.0.1, but understand that the real exposure is the gap between what 'read-only' is assumed to mean and what the API actually permits.

Reviewed through automated stages and approved by a human before publication.