CVE-2026-44884
Portainer: Missing authorization on custom template file endpoint exposes template content
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint (GET /api/custom_templates/{id}/file) allows any authenticated user to read the file content of any custom template by enumerating sequential integer IDs, bypassing Resource Control access restrictions. Template files may contain environment-specific values such as connection strings, API tokens, or registry credentials that administrators would not expect standard users to read. This vulnerability is fixed in 2.33.8 and 2.39.1.
| CWE | CWE-862 |
| Vendor | portainer |
| Product | portainer |
| Published | May 28, 2026 |
| Last Updated | May 29, 2026 |
Get instant alerts for portainer portainer
Be the first to know when new unknown vulnerabilities affecting portainer portainer are published — delivered to Slack, Telegram or Discord.