6.5
Medium
CVE-2025-4374 A flaw was found in Quay
Description
A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| quay 3.12 | 3.12.0 → < 3.12.10 | 3.12.10 |
| quay 3.11 | earliest → < 3.11.11 | 3.11.11 |
| quay 2.14 | 2.14.0 → < 3.14.2 | 3.14.2 |
| Red Hat Quay 3 3.12 | earliest → < 3.12.10-3 | 3.12.10-3 |