CVE-2026-111667
Received Received - Intake

REBUILD Missing Authorization in TaskCommentController.commentList

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111667
EUVD
EUVD-2026-102958

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getrebuild rebuild 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in REBUILD through 4.5.0 allows authenticated low-privileged users to read task comments from private projects without proper authorization checks. By providing a task ID from a restricted project, attackers can access comment content and attachment references via the /project/comments/list endpoint.

Detection Guidance

Check REBUILD application logs for unauthorized access attempts to /project/comments/list endpoint. Monitor network traffic for requests to this endpoint with task IDs from private projects. Review user permissions to ensure low-privileged users cannot access task comments outside their projects.

Impact Analysis

An attacker could exploit this to access sensitive internal discussions, project details, or confidential attachments in private projects. This may lead to data leaks, intellectual property theft, or unauthorized access to restricted information.

Mitigation Strategies

Upgrade REBUILD to version 4.5.1 or later. Implement strict project membership validation in TaskCommentController.commentList. Restrict access to /project/comments/list endpoint to authorized users only. Review and audit user permissions to ensure least privilege access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart