CVE-2026-59097

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9
https://github.com/taigaio/taiga-back/issues/244
https://github.com/taigaio/taiga-back/pull/245
https://github.com/taigaio/taiga-back/releases/tag/6.10.2
https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets
https://github.com/taigaio/taiga-back/issues/244

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Taiga anterior a la versión 6.10.2 contiene una vulnerabilidad de autorización faltante que permite a atacantes remotos no autenticados crear registros de fechas de vencimiento predeterminadas en cualquier proyecto explotando puntos finales POST desprotegidos en los viewsets de la API de fechas de vencimiento de historias de usuario, tareas e incidencias. Los atacantes pueden suministrar un identificador de proyecto arbitrario a estos puntos finales, lo que omite las comprobaciones de permisos y aplica el valor predeterminado AllowAny, para adelantarse a los administradores de proyectos en la inicialización de fechas de vencimiento creando registros antes de que ellos mismos puedan hacerlo.

Information

Published : 2026-07-02 20:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-59097

Mitre link : CVE-2026-59097

CVE.ORG link : CVE-2026-59097

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-59097", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59097", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T14:50:31.230166Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/taigaio/taiga-back", "vendor": "taiga", "product": "taiga-back", "versions": [{"status": "affected", "version": "0", "lessThan": "6.10.2", "versionType": "semver"}], "packageURL": "pkg:github/taigaio/taiga-back", "defaultStatus": "unaffected"}]}], "published": "2026-07-02T20:17:07.990", "references": [{"url": "https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/taigaio/taiga-back/issues/244", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/taigaio/taiga-back/pull/245", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/taigaio/taiga-back/releases/tag/6.10.2", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/taigaio/taiga-back/issues/244", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves."}, {"lang": "es", "value": "Taiga anterior a la versi\u00f3n 6.10.2 contiene una vulnerabilidad de autorizaci\u00f3n faltante que permite a atacantes remotos no autenticados crear registros de fechas de vencimiento predeterminadas en cualquier proyecto explotando puntos finales POST desprotegidos en los viewsets de la API de fechas de vencimiento de historias de usuario, tareas e incidencias. Los atacantes pueden suministrar un identificador de proyecto arbitrario a estos puntos finales, lo que omite las comprobaciones de permisos y aplica el valor predeterminado AllowAny, para adelantarse a los administradores de proyectos en la inicializaci\u00f3n de fechas de vencimiento creando registros antes de que ellos mismos puedan hacerlo."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "disclosure@vulncheck.com"}