CVE-2026-31874

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-31874

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31874.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-31874

Aliases

GHSA-r6gj-4663-p5mr

Published

2026-03-11T18:13:33.936Z

Modified

2026-04-02T13:24:08.278184Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration

Details

Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore client-supplied role parameters, the server accepts the manipulated value and creates the account with SUPER_ADMIN privileges. This allows any unauthenticated attacker to register a fully privileged administrative account.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284",
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31874.json"
}

References

Affected packages

Git / github.com/taskosaur/taskosaur

Affected ranges

Type: GIT
Repo: https://github.com/taskosaur/taskosaur
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

159a5a8f43761561100a57d34309830550028932

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31874.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.0.0"
            }
        ]
    }
]