9 matches found
CVE-2026-111667
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/lis...
EUVD-2026-102958
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/lis...
CVE-2026-111667 REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/lis...
CVE-2026-111667
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/lis...
CVE-2026-111667 REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/lis...
CVE-2026-111667
REBUILD through version 4.5.0 contains a missing authorization vulnerability in the TaskCommentController.commentList component. Due to a lack of project membership checks, authenticated low-privileged users can access the /project/comments/list endpoint to retrieve comment content and attachment...
PT-2026-116066
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/lis...
CVE-2026-111667: Authorization Bypass Through User-Controlled Key
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/lis...
Getrebuild Rebuild authorization issue vulnerability
Getrebuild Rebuild 4.5.0 and earlier versions have an authorization issue. This vulnerability stems from a lack of authorization checks in the TaskCommentController.commentList component. It allows authenticated, low-privilege users to read task comments without having project membership. Attacke...