Description
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Canonical Juju
Default version status: unaffected
4.0 to < 4.0.16affected