CVE-2026-53552 affects Goploy, an open-source automation deployment system, in versions 1.17.5 and prior. The vulnerability is an Insecure Direct Object Reference (IDOR) in project handler functions (AddFile, EditFile, RemoveFile, Edit) that fail to verify namespace ownership before acting on submitted row IDs. A user with the manager role or FileSync/EditProject permissions in their own namespace can read, write, or delete files belonging to any project across the entire installation. More critically, they can rewrite any project's git remote URL by submitting a foreign project ID. This git URL manipulation escalates to Remote Code Execution (RCE) on the next deployment cycle, as the Edit function executes 'git remote set-url' on the project's working tree. No publicly available patches exist at the time of publication, making this an unmitigated high-severity vulnerability.
