CVE-2026-11438

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11438", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-05T22:21:00.483Z", "datePublished": "2026-06-06T17:00:14.794Z", "dateUpdated": "2026-06-08T15:34:51.047Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-06T17:00:14.794Z"}, "title": "theonedev projects improper authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "theonedev", "product": "onedev", "versions": [{"version": "15.0.0", "status": "affected"}, {"version": "15.0.1", "status": "affected"}, {"version": "15.0.2", "status": "affected"}, {"version": "15.0.3", "status": "affected"}, {"version": "15.0.4", "status": "affected"}, {"version": "15.0.5", "status": "affected"}, {"version": "15.0.6", "status": "unaffected"}], "cpes": ["cpe:2.3:a:theonedev:onedev:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipulation of the argument project.forkedFromId leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 15.0.6 addresses this issue. Upgrading the affected component is recommended."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-06-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-06T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-06T00:26:13.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "aibot88 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/369018", "name": "VDB-369018 | theonedev projects improper authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/369018/cti", "name": "VDB-369018 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11438", "name": "CVE-2026-11438 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/822944", "name": "Submit #822944 | theonedev onedev 15.05 BOPLA", "tags": ["third-party-advisory"]}, {"url": "https://www.cnblogs.com/aibot/p/19994142", "tags": ["related"]}, {"url": "https://github.com/theonedev/onedev/releases/tag/v15.0.6", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T15:34:41.417873Z", "id": "CVE-2026-11438", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T15:34:51.047Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11438", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T15:34:41.417873Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T15:34:47.573Z"}}], "cna": {"title": "theonedev projects improper authorization", "credits": [{"lang": "en", "type": "reporter", "value": "aibot88 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:theonedev:onedev:*:*:*:*:*:*:*:*"], "vendor": "theonedev", "product": "onedev", "versions": [{"status": "affected", "version": "15.0.0"}, {"status": "affected", "version": "15.0.1"}, {"status": "affected", "version": "15.0.2"}, {"status": "affected", "version": "15.0.3"}, {"status": "affected", "version": "15.0.4"}, {"status": "affected", "version": "15.0.5"}, {"status": "unaffected", "version": "15.0.6"}]}], "timeline": [{"lang": "en", "time": "2026-06-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-06T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-06T00:26:13.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/369018", "name": "VDB-369018 | theonedev projects improper authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/369018/cti", "name": "VDB-369018 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11438", "name": "CVE-2026-11438 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/822944", "name": "Submit #822944 | theonedev onedev 15.05 BOPLA", "tags": ["third-party-advisory"]}, {"url": "https://www.cnblogs.com/aibot/p/19994142", "tags": ["related"]}, {"url": "https://github.com/theonedev/onedev/releases/tag/v15.0.6", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipulation of the argument project.forkedFromId leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 15.0.6 addresses this issue. Upgrading the affected component is recommended."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-06T17:00:14.794Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11438", "state": "PUBLISHED", "dateUpdated": "2026-06-08T15:34:51.047Z", "dateReserved": "2026-06-05T22:21:00.483Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-06T17:00:14.794Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:theonedev:onedev:*:*:*:*:*:*:*:*"], "product": "onedev", "vendor": "theonedev", "versions": [{"status": "affected", "version": "15.0.0"}, {"status": "affected", "version": "15.0.1"}, {"status": "affected", "version": "15.0.2"}, {"status": "affected", "version": "15.0.3"}, {"status": "affected", "version": "15.0.4"}, {"status": "affected", "version": "15.0.5"}, {"status": "unaffected", "version": "15.0.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipulation of the argument project.forkedFromId leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 15.0.6 addresses this issue. Upgrading the affected component is recommended."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en theonedev onedev hasta la versi\u00f3n 15.0.5. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo /projects. La manipulaci\u00f3n del argumento project.forkedFromId conduce a una autorizaci\u00f3n indebida. El ataque es posible llevarlo a cabo de forma remota. La actualizaci\u00f3n a la versi\u00f3n 15.0.6 soluciona este problema. Se recomienda actualizar el componente afectado."}], "id": "CVE-2026-11438", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11438", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T15:34:41.417873Z", "version": "2.0.3"}}]}, "published": "2026-06-06T17:16:41.713", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/theonedev/onedev/releases/tag/v15.0.6"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-11438"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/822944"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369018"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369018/cti"}, {"source": "cna@vuldb.com", "url": "https://www.cnblogs.com/aibot/p/19994142"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[15.0.0,15.0.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "15.0.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "onedev", "source": "cna", "vendor": "theonedev"}, "product": "onedev", "vendor": "theonedev"}], "created": "2026-06-06T18:30:26.630836+00:00", "updated": "2026-06-06T19:30:27.395682+00:00", "vendors": ["theonedev", "theonedev$PRODUCT$onedev"]}