CVE-2026-69119

Received Received - Intake

Missing Authorization in Taubyte Tau v1.1.10 Allows Project Takeover

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/{id} endpoints. The GitHubTokenHTTPAuth middleware only validates that a caller presents a valid GitHub OAuth token without verifying ownership or access rights to the target project, enabling attackers with any valid GitHub token to invoke bare KV-store operations such as projects.Fetch and project.Delete against any project ID to achieve cross-tenant project takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-69119

EUVD

EUVD-2026-56903

Affected Vendors & Products

Vendor	Product	Version / Range
taubyte	tau	to 1.1.10 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-69119 is a missing authorization vulnerability in Taubyte Tau v1.1.10. It allows any authenticated user with a valid GitHub OAuth token to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/{id} endpoints. The system fails to verify if the user has ownership or access rights to the target project, enabling cross-tenant project takeover.

Detection Guidance

To detect this vulnerability, check if your Taubyte Tau instance is running version 1.1.10 or earlier. Verify if the services/auth component lacks proper authorization checks for project access. Inspect API logs for unauthorized GET or DELETE requests to /projects/{id} endpoints with arbitrary project IDs. Look for exposed project IDs in API responses or GitHub repositories linked to projects.

Impact Analysis

This vulnerability can lead to confidentiality breaches by allowing unauthorized users to read project details. It also poses integrity and availability risks by enabling permanent deletion of projects. In multi-user deployments, attackers could achieve full cross-tenant project takeover. The impact includes unauthorized data access, data loss, and potential disruption of services.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA due to unauthorized access and deletion of project data. GDPR requires strict data protection and user consent for processing, while HIPAA mandates safeguards for protected health information. Unauthorized access or deletion of tenant projects may result in data breaches, loss of confidentiality, and failure to meet compliance requirements for data integrity and availability.

Mitigation Strategies

Immediately upgrade Taubyte Tau to a patched version that includes the authorization fixes. Ensure the new version implements proper access control checks for project operations. Review and restrict API access to only authorized users. Monitor for any unauthorized project deletions or data leaks.

Hi! I’m here to help you understand CVE-2026-69119. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70