CVE-2026-65055

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-65055

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65055.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-65055

Published

2026-07-21T20:43:53Z

Modified

2026-10-02T03:30:53Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Taiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints

Details

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65055.json"
}

References

Affected packages

Git / github.com/taigaio/taiga-back

Affected ranges

Type

GIT

Repo

https://github.com/taigaio/taiga-back

Events

Introduced

df14a4bdaee662962e343e3c4cd3fcd6a1339de7

Last Affected

df14a4bdaee662962e343e3c4cd3fcd6a1339de7

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "6.10.1"
        },
        {
            "last_affected":  "6.10.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

6.*

6.10.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65055.json"