CVE-2026-31874 | Taskosaur is an open source project management platform with… | CVSS 9.8 CRITICAL

Description

Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore client-supplied role parameters, the server accepts the manipulated value and creates the account with SUPER_ADMIN privileges. This allows any unauthenticated attacker to register a fully privileged administrative account.

Metadata

CVE ID: CVE-2026-31874
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-03-09 19:02 UTC
Published: 2026-03-11 18:13 UTC
Last updated: 2026-03-12 20:08 UTC
Primary CWE: CWE-284
CWE-284: Improper Access Control
Vendor / Product: Taskosaur / Taskosaur
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Taskosaur	Taskosaur	—	1.0.0

Weakness (CWE)

CWE	Source	Description
CWE-284	cna	CWE-284: Improper Access Control
CWE-639	cna	CWE-639: Authorization Bypass Through User-Controlled Key

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)

https://github.com/Taskosaur/Taskosaur/security/advisories/GHSA-r6gj-4663-p5mr https://github.com/Taskosaur/Taskosaur/security/advisories/GHSA-r6gj-4663-p5mr
https://github.com/Taskosaur/Taskosaur/commit/159a5a8f43761561100a57d34309830550028932 https://github.com/Taskosaur/Taskosaur/commit/159a5a8f43761561100a57d34309830550028932