CVE-2026-65055

Deferred Deferred - Pending Action

Taiga 6.10.1 Missing Authorization Exposes Private Project Data

Publication date: 2026-07-21

Last updated on: 2026-07-23

Assigner: VulnCheck

Description

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-23

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-65055

Affected Vendors & Products

Vendor	Product	Version / Range
taiga	taiga	6.10.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Taiga 6.10.1 has a missing authorization vulnerability allowing unauthenticated attackers to access private project details. By sending GET requests to specific API endpoints with project IDs, attackers can retrieve member rosters and internal workflow configurations of private projects without proper access permissions.

Detection Guidance

To detect this vulnerability, monitor for unauthenticated GET requests to the filters_data API endpoints (UserStory, Task, Issue, Epic viewsets) with sequential integer project IDs. Check server logs for unusual access patterns to these endpoints.

Impact Analysis

This vulnerability allows attackers to gather sensitive information about private projects, including user IDs, names, and profile pictures. It could lead to further attacks like targeted phishing, social engineering, or unauthorized access to project data if combined with other exploits.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR and HIPAA by exposing personal and sensitive project data without authorization. Organizations could face legal penalties, reputational damage, and loss of trust due to unauthorized data disclosure.

Mitigation Strategies

Immediately upgrade Taiga to a patched version beyond 6.10.1. Temporarily restrict access to the filters_data endpoints via firewall rules or web application firewall (WAF) until patched. Review server logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-65055. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70