Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control.

Devtron versions through 2.2.0 contain a missing authorization vulnerability on the GET /orchestrator/api-token/webhook endpoint. Any authenticated user, regardless of privilege level, can query this endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens. These tokens grant full platform control over the Devtron CI/CD orchestration platform. The vulnerability stems from a failure to enforce proper authorization checks in the API token webhook handler. Successful exploitation allows privilege escalation from any authenticated account to full administrative access. The issue is documented in GitHub issue #7013 and affects the ApiTokenRestHandler and ApiTokenService components. No special permissions or exploitation techniques are required beyond basic authentication.