CVE-2026-10284

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10284
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10284.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10284
Published
2026-06-01T19:00:09.664Z
Modified
2026-08-12T03:51:28.293590287Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization
Details

A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this vulnerability is the function editComment/doDeleteComment of the file app/Filament/Resources/TicketResource/Pages/ViewTicket.php of the component Livewire Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cwe_ids": [
        "CWE-266",
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10284.json",
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/devaslanphp/project-management

Affected ranges

Type
GIT
Repo
https://github.com/devaslanphp/project-management
Events
Introduced
ac327ba97e86909c388d5fc1ef38c3932d13577a
Last affected
ac327ba97e86909c388d5fc1ef38c3932d13577a
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.0.0-beta1"
        },
        {
            "last_affected": "2.0.0-beta1"
        }
    ]
}

Affected versions

2.*
2.0.0-beta1
v2.*
v2.0.0-beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10284.json"