ETK-2026-3039Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3039",
  "cve_id": null,
  "display_id": "ETK-2026-3039",
  "ghsa_id": "GHSA-8r3h-vc36-6xpx",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Cross-project authorization flaw in Incus default-project access",
  "summary": "Incus versions before v7.6.0 may allow restricted-certificate clients to read named resources in the default project despite lacking an inheriting project relationship. In affected access paths, viewers may also export custom volume or bucket backups, exposing stored data or credentials when they know the resource name.",
  "mitigation": "Upgrade github.com/lxc/incus/v7/cmd/incusd to >= v7.6.0 or later.",
  "vendor": "go",
  "product": "go:github.com/lxc/incus/v7/cmd/incusd",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< v7.6.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        ">= v7.6.0"
      ],
      "package_name": "github.com/lxc/incus/v7/cmd/incusd",
      "purl": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd"
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 7.277808716666667,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T22:18:13+00:00",
      "days": -0.37894674150462965,
      "is_lower_bound": true,
      "measured_at": "2026-10-30T07:23:54.069085+00:00",
      "url": "https://github.com/lxc/incus/security/advisories/GHSA-8r3h-vc36-6xpx"
    }
  }
}