CVE-2026-11441
Improper Authorization in OneDev up to 15.0.5
Publication date: 2026-06-06
Last updated on: 2026-06-06
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| theonedev | onedev | to 15.0.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves improper authorization in the canAccessIssue function, which could allow unauthorized access to issue data remotely.
Such unauthorized access to potentially sensitive project management and issue tracking information may lead to exposure of confidential data.
Exposure of sensitive or personal data due to improper authorization could impact compliance with data protection regulations such as GDPR or HIPAA, which require strict access controls to protect personal and sensitive information.
Therefore, this vulnerability could pose a risk to compliance with these standards if exploited, by enabling unauthorized data access.
Upgrading to version 15.0.6 is recommended to resolve this issue and help maintain compliance.
Can you explain this vulnerability to me?
This vulnerability exists in theonedev onedev versions up to 15.0.5, specifically in the function canAccessIssue within the /issues/ file of the Pull Request Handler component. The issue arises from improper authorization due to manipulation of the argument 'issue'. This flaw allows an attacker to remotely exploit the system by bypassing proper access controls.
Upgrading to version 15.0.6 resolves this vulnerability.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to issues within the affected system, potentially exposing sensitive information or allowing unauthorized actions on pull requests. Since the attack can be launched remotely, it increases the risk of exploitation without physical access.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the affected component, theonedev onedev, to version 15.0.6 or later.
This upgrade resolves the improper authorization issue in the canAccessIssue function of the Pull Request Handler component.