Docker Hub access token flaw let users act as others via PATs

On September 30 a researcher reported a flaw in Docker Hub's identity and access management: when converting a personal account to an organization, one user could take on another user's capabilities through a personal access token. Docker said it fixed the issue in about four hours and saw no signs of exploitation.

• Flaw affected personal access tokens during personal-to-organization conversion
• Docker fixed it in roughly four hours after the September 30 report
• No signs of exploitation were observed, Docker said
• A maintainer verified 42 cosign-signed images against CI runs