CVE-2026-104991
Received Received - Intake

Phproject REST API Missing Authorization in Issue Endpoints

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-03
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104991
EUVD
EUVD-2026-91776

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
alanaktion phproject to 1.8.7 (exc)
alanaktion phproject 1.8.7
phproject phproject to 1.8.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104991 is a missing object-level authorization flaw in Phproject's REST API issue endpoints (single_get, single_comments, single_comments_post) affecting versions before 1.8.7. It allows authenticated API key holders to bypass access controls by skipping the required authorization check, enabling unauthorized reading of restricted issues and posting comments to issues they should not access.

Detection Guidance

To detect this vulnerability, check if your Phproject instance is running a version before 1.8.7. Use commands like 'curl -s https://your-phproject-url/ | grep -i version' or check the version in the admin panel. Verify if the affected API endpoints (single_get, single_comments, single_comments_post) are accessible with a valid API key by attempting to fetch restricted issue data.

Impact Analysis

Attackers with a valid API key can read sensitive issue details like owner and author email addresses, view restricted issue contents, and post unauthorized comments. The flaw requires low privileges and no user interaction, making it easy to exploit. Persistent attacks are possible with long-lived API keys.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data such as email addresses, which are considered personal data under GDPR and PHI under HIPAA. The lack of object-level authorization checks in the REST API allows attackers to bypass confidentiality controls, potentially violating compliance requirements for data protection and access controls.

Mitigation Strategies

Immediately upgrade Phproject to version 1.8.7 or later. After upgrading, revoke all existing API keys and issue new ones. Review and restrict API key permissions to the minimum required. Monitor logs for unauthorized access attempts to the affected endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart