CVE-2026-65055

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/taigaio/taiga-back
https://github.com/taigaio/taiga-back/issues/246
https://www.vulncheck.com/advisories/taiga-taiga-back-private-project-member-roster-disclosure-via-unauthenticated-filters-data-endpoints
https://github.com/taigaio/taiga-back/issues/246

Configurations

No configuration.

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Taiga 6.10.1 contiene una vulnerabilidad de autorización faltante que permite a atacantes no autenticados divulgar la lista completa de miembros y la configuración interna del flujo de trabajo de cualquier proyecto privado al proporcionar un ID de proyecto a los endpoints de la API filters_data en los viewsets de UserStory, Task, Issue y Epic. Los atacantes pueden enviar solicitudes GET no autenticadas a los endpoints de filters_data con IDs de proyecto enteros secuenciales para enumerar los detalles de membresía de proyectos privados, incluyendo IDs de usuario, nombres completos y hashes de gravatar, eludiendo los controles de acceso que restringen correctamente otros endpoints de la API del proyecto.

Information

Published : 2026-07-21 21:16

Updated : 2026-10-24 19:10

NVD link : CVE-2026-65055

Mitre link : CVE-2026-65055

CVE.ORG link : CVE-2026-65055

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-65055", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65055", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T14:11:19.643713Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Taiga", "product": "taiga-back", "versions": [{"status": "affected", "version": "6.10.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-21T21:16:54.157", "references": [{"url": "https://github.com/taigaio/taiga-back", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/taigaio/taiga-back/issues/246", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/taiga-taiga-back-private-project-member-roster-disclosure-via-unauthenticated-filters-data-endpoints", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/taigaio/taiga-back/issues/246", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints."}, {"lang": "es", "value": "Taiga 6.10.1 contiene una vulnerabilidad de autorizaci\u00f3n faltante que permite a atacantes no autenticados divulgar la lista completa de miembros y la configuraci\u00f3n interna del flujo de trabajo de cualquier proyecto privado al proporcionar un ID de proyecto a los endpoints de la API filters_data en los viewsets de UserStory, Task, Issue y Epic. Los atacantes pueden enviar solicitudes GET no autenticadas a los endpoints de filters_data con IDs de proyecto enteros secuenciales para enumerar los detalles de membres\u00eda de proyectos privados, incluyendo IDs de usuario, nombres completos y hashes de gravatar, eludiendo los controles de acceso que restringen correctamente otros endpoints de la API del proyecto."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "disclosure@vulncheck.com"}