Authorization Bypass

github.com/argoproj/argo-cd is vulnerable to Authorization Bypass. The vulnerability exists due to the canProcessApp function in appcontroller.go, which permits a remote authenticated user to deploy applications outside of the intended namespace when sharding is enabled on the application controller because the it doesn’t enforce the comma-delimited list of glob patterns when reconciling Applications.