Taiga Missing Authorization in Default Due-Date Records

Executive Summary

CVE-2026-59097 is a missing authorization vulnerability in Taiga versions before 6.10.2. It allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets.

The vulnerability exists because the 'create_default' actions in these API endpoints do not perform permission checks, allowing attackers to supply arbitrary project identifiers and bypass the required project administrator permissions.

As a result, attackers can pre-empt project administrators by creating due-date records before legitimate users can initialize them.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to interfere with project management workflows.

• Attackers can create default due-date records in any project without authentication.
• This can disrupt project administration by preempting project administrators from setting due dates themselves.
• Such interference may cause confusion, mismanagement of tasks, and potential delays in project timelines.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized POST requests to the API endpoints related to due-date creation in Taiga projects. Specifically, look for POST requests to the user-story, task, and issue due-date API viewsets that include a project_id parameter.

You can use network monitoring tools or web server logs to identify such requests. For example, using curl or similar tools, you can test if the endpoints accept unauthenticated POST requests by sending a request like:

• curl -X POST https://your-taiga-instance/api/v1/userstoryduedate/create_default/ -d 'project_id=1'
• curl -X POST https://your-taiga-instance/api/v1/taskduedate/create_default/ -d 'project_id=1'
• curl -X POST https://your-taiga-instance/api/v1/issueduedate/create_default/ -d 'project_id=1'

If these requests succeed without authentication or permission errors, your system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Taiga to version 6.10.2 or later, where the vulnerability has been fixed by adding proper permission checks to the affected API endpoints.

If upgrading is not immediately possible, restrict access to the affected API endpoints by implementing network-level controls such as firewall rules or API gateway restrictions to block unauthenticated POST requests to the due-date creation endpoints.

Additionally, monitor logs for suspicious POST requests to these endpoints and alert on any unauthorized attempts.

Useful 0 Not Useful 0