---
id: CVE-2023-50726
aliases:
  - GHSA-g623-jcgg-mhmm
  - BIT-argo-cd-2023-50726
  - GO-2024-2643
title: Users with `create` but not `override` privileges can perform local sync
summary: Users with `create` but not `override` privileges can perform local sync
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L'
vendor: argoproj
product: github.com/argoproj/argo-cd
ecosystem: go
affected:
  - 'github.com/argoproj/argo-cd >= 1.2.0-rc1, <= 1.8.7'
  - 'github.com/argoproj/argo-cd/v2 >= 2.9.0, < 2.9.8'
  - 'github.com/argoproj/argo-cd/v2 >= 2.10.0, < 2.10.3'
  - 'github.com/argoproj/argo-cd/v2 >= 2.0.0-rc3, < 2.8.12'
patched:
  - github.com/argoproj/argo-cd/v2 2.9.8
  - github.com/argoproj/argo-cd/v2 2.10.3
  - github.com/argoproj/argo-cd/v2 2.8.12
published: '2024-03-15'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g623-jcgg-mhmm'
references:
  - url: >-
      https://github.com/argoproj/argo-cd/security/advisories/GHSA-g623-jcgg-mhmm
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-50726'
  - url: >-
      https://github.com/argoproj/argo-cd/commit/3b8f673f06c2d228e01cbc830e5cb57cef008978
  - url: 'https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac'
  - url: 'https://github.com/argoproj/argo-cd'
tags:
  - osv
  - go
epss: 0.00532
epssPercentile: 0.4257
ingestedAt: '2026-08-07T19:14:16.991Z'
---

## Overview

### Impact

"Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git.

An improper validation bug allows users who have `create` privileges but not `override` privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is _not_ enforced is that the manifests come from some approved git/Helm/OCI source.

The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added.

### Patches

The bug has been patched in the following versions:

* 2.10.3
* 2.9.8
* 2.8.12

### Workarounds

To immediately mitigate the risk of branch protection bypass, remove `applications, create` RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.

Branch protection rules and review requirements are a great way to enforce security constraints in a GitOps environment, but they should be just one layer in a multi-layered approach. Make sure your AppProject and RBAC restrictions are as thorough as possible to prevent a review bypass vulnerability from permitting excessive damage.

### References

* [Argo CD RBAC documentation](https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac/)

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd

## Affected packages

- `github.com/argoproj/argo-cd >= 1.2.0-rc1, <= 1.8.7`
- `github.com/argoproj/argo-cd/v2 >= 2.9.0, < 2.9.8`
- `github.com/argoproj/argo-cd/v2 >= 2.10.0, < 2.10.3`
- `github.com/argoproj/argo-cd/v2 >= 2.0.0-rc3, < 2.8.12`

## Remediation

Upgrade to a patched release:

- `github.com/argoproj/argo-cd/v2 2.9.8`
- `github.com/argoproj/argo-cd/v2 2.10.3`
- `github.com/argoproj/argo-cd/v2 2.8.12`