CVE-2026-69119

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...

CVE-2026-69119: Authorization Bypass Through User-Controlled Key

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...

Taubyte authorization issue vulnerability

Version 1.1.10 of Taubyte contains an authorization issue vulnerability. This vulnerability arises because the GitHubTokenHTTPAuth middleware in the services/auth HTTP service only validates the validity of a GitHub OAuth token without checking whether the target project is owned or has access...