Taiga 6.10.1 Missing Authorization Exposes Private Project Data

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-65055

Affected Vendors & Products

Vendor	Product	Version / Range
taiga	taiga	6.10.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Detection Guidance

To detect this vulnerability, monitor for unauthenticated GET requests to the filters_data API endpoints (UserStory, Task, Issue, Epic viewsets) with sequential integer project IDs. Check server logs for unusual access patterns to these endpoints.

Mitigation Strategies

Immediately upgrade Taiga to a patched version beyond 6.10.1. Temporarily restrict access to the filters_data endpoints via firewall rules or web application firewall (WAF) until patched. Review server logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-65055. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70