title: Cloud Controller allows users with no roles to list droplets
description: Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).
problem types: CWE-863: Incorrect Authorization
affected:
{
product: CAPI
vendor: Cloud Foundry
versions:
lessThan: 1.98.0, status: affected, version: All, versionType: custom
}
{
product: CF Deployment
vendor: Cloud Foundry
versions:
lessThan: 13.17.0, status: affected, version: All, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.0
]