🚨 CVE-2026-66380
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.