The permission called 'cache-deploy' obscures a critical access boundary that your operators likely don't understand. It sounds like a confined operational capability — deploy caches, nothing more — but it implicitly carries content-read access with an unstated path constraint. That constraint is the architectural trap: the permission grants escape from its own boundary when path configuration is misstated or absent.
This isn't a missing check in the traditional sense. It's a semantic failure: the permission model promises operational scope, but the security model delivers content exposure under specific configuration conditions. When you grant cache-deploy to a service that legitimately needs cache access, you may be granting an escape hatch you never intended.
What to do now: First, audit every service currently holding cache-deploy. Treat each grant as a potential content-read exposure until proven otherwise — the permission name created false assurance, and the proliferation is likely wider than your incident logs show. Second, implement path bounds enforcement at the permission layer, not the application layer; adding validation in code downstream doesn't fix the contract, it just papers over the mismatch and creates edge cases for the next vulnerability in this family. Third, decompose this permission into explicit read and write capabilities with documented path scopes — the fix will likely add structural validation, but without semantic clarity in the permission contract, the same pattern reappears in variant form.
The CVSS 5.3 and EPSS score reflect external exploitability, which misreads where the real risk lives. In multi-tenant deployment pipelines, the vulnerability surface isn't external attackers — it's lateral movement within a trusted operational context, where services that already passed security review hold permissions whose contracts they never understood.