Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supp…
Medium CVSS 5.3
Summary
Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gra…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/taigaio/taiga-back
- https://github.com/taigaio/taiga-back/issues/246
- https://www.vulncheck.com/advisories/taiga-taiga-back-private-project-member-roster-disclosure-via-unauthenticated-filters-data-endpoints
Timeline
- nvd_ingest NVD