Back to overview

CVE-2026-65055

MEDIUM
5.3
CVSS 3.1
Description
Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.

Metadata

CVE ID
CVE-2026-65055
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-21 14:05 UTC
Published
2026-07-21 20:43 UTC
Last updated
2026-07-21 20:43 UTC
Primary CWE
CWE-862
Missing Authorization
Vendor / Product
Taiga / taiga-back
Sources
cve.org  ·  NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products (1)
VendorProductPlatformVersions
Taiga taiga-back — 6.10.1
Weakness (CWE)
CWESourceDescription
CWE-862 cna Missing Authorization
CVSS scores (2)
ScoreSeverityVersionSourceVector
6.9 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References (3)
Back to overview