Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.

A vulnerability exists in the Nuclio Serverless framework's Dashboard project management API prior to version 1.16.0. Any authenticated user, regardless of project membership, can bypass OPA (Open Policy Agent) authorization checks on write paths. Specifically, the PUT /api/projects/{id} and DELETE /api/projects endpoints are affected. Exploitation allows unauthorized modification or deletion of any project and all associated resources including functions and API gateways. The vulnerability does not require elevated privileges, only valid authentication. The issue has been fully patched in Nuclio version 1.16.0. Users are advised to upgrade immediately to mitigate unauthorized access risks. The fix is documented in a public GitHub commit, pull request, and security advisory.