CVE-2026-11441

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11441", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-05T22:21:08.343Z", "datePublished": "2026-06-06T17:45:10.650Z", "dateUpdated": "2026-06-08T16:33:38.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-06T17:45:10.650Z"}, "title": "theonedev Pull Request issues canAccessIssue improper authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "theonedev", "product": "onedev", "versions": [{"version": "15.0.0", "status": "affected"}, {"version": "15.0.1", "status": "affected"}, {"version": "15.0.2", "status": "affected"}, {"version": "15.0.3", "status": "affected"}, {"version": "15.0.4", "status": "affected"}, {"version": "15.0.5", "status": "affected"}, {"version": "15.0.6", "status": "unaffected"}], "cpes": ["cpe:2.3:a:theonedev:onedev:*:*:*:*:*:*:*:*"], "modules": ["Pull Request Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely. Upgrading to version 15.0.6 is able to resolve this issue. It is advisable to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-06-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-06T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-06T00:26:22.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "aibot88 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/369021", "name": "VDB-369021 | theonedev Pull Request issues canAccessIssue improper authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/369021/cti", "name": "VDB-369021 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11441", "name": "CVE-2026-11441 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/822957", "name": "Submit #822957 | theonedev onedev 15.05 BOPLA", "tags": ["third-party-advisory"]}, {"url": "https://www.cnblogs.com/aibot/p/19994142", "tags": ["related"]}, {"url": "https://github.com/theonedev/onedev/releases/tag/v15.0.6", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T14:18:20.406637Z", "id": "CVE-2026-11441", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T16:33:38.173Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11441", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T14:18:20.406637Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T14:18:25.329Z"}}], "cna": {"title": "theonedev Pull Request issues canAccessIssue improper authorization", "credits": [{"lang": "en", "type": "reporter", "value": "aibot88 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:theonedev:onedev:*:*:*:*:*:*:*:*"], "vendor": "theonedev", "modules": ["Pull Request Handler"], "product": "onedev", "versions": [{"status": "affected", "version": "15.0.0"}, {"status": "affected", "version": "15.0.1"}, {"status": "affected", "version": "15.0.2"}, {"status": "affected", "version": "15.0.3"}, {"status": "affected", "version": "15.0.4"}, {"status": "affected", "version": "15.0.5"}, {"status": "unaffected", "version": "15.0.6"}]}], "timeline": [{"lang": "en", "time": "2026-06-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-06T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-06T00:26:22.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/369021", "name": "VDB-369021 | theonedev Pull Request issues canAccessIssue improper authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/369021/cti", "name": "VDB-369021 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11441", "name": "CVE-2026-11441 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/822957", "name": "Submit #822957 | theonedev onedev 15.05 BOPLA", "tags": ["third-party-advisory"]}, {"url": "https://www.cnblogs.com/aibot/p/19994142", "tags": ["related"]}, {"url": "https://github.com/theonedev/onedev/releases/tag/v15.0.6", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely. Upgrading to version 15.0.6 is able to resolve this issue. It is advisable to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-06T17:45:10.650Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11441", "state": "PUBLISHED", "dateUpdated": "2026-06-08T16:33:38.173Z", "dateReserved": "2026-06-05T22:21:08.343Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-06T17:45:10.650Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:theonedev:onedev:*:*:*:*:*:*:*:*"], "modules": ["Pull Request Handler"], "product": "onedev", "vendor": "theonedev", "versions": [{"status": "affected", "version": "15.0.0"}, {"status": "affected", "version": "15.0.1"}, {"status": "affected", "version": "15.0.2"}, {"status": "affected", "version": "15.0.3"}, {"status": "affected", "version": "15.0.4"}, {"status": "affected", "version": "15.0.5"}, {"status": "unaffected", "version": "15.0.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely. Upgrading to version 15.0.6 is able to resolve this issue. It is advisable to upgrade the affected component."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en theonedev onedev hasta la versi\u00f3n 15.0.5. Esta vulnerabilidad afecta a la funci\u00f3n canAccessIssue del archivo /issues/ del componente Gestor de Solicitudes de Extracci\u00f3n. Dicha manipulaci\u00f3n del argumento issue conduce a una autorizaci\u00f3n indebida. Es posible lanzar el ataque de forma remota. La actualizaci\u00f3n a la versi\u00f3n 15.0.6 puede resolver este problema. Es aconsejable actualizar el componente afectado."}], "id": "CVE-2026-11441", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11441", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T14:18:20.406637Z", "version": "2.0.3"}}]}, "published": "2026-06-06T18:16:53.443", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/theonedev/onedev/releases/tag/v15.0.6"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-11441"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/822957"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369021"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369021/cti"}, {"source": "cna@vuldb.com", "url": "https://www.cnblogs.com/aibot/p/19994142"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "15.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "15.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "15.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "15.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "15.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "15.0.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "15.0.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "onedev", "source": "cna", "vendor": "theonedev"}, "product": "onedev", "vendor": "theonedev"}], "created": "2026-06-06T19:30:27.395098+00:00", "updated": "2026-06-06T20:00:16.276729+00:00", "vendors": ["theonedev", "theonedev$PRODUCT$onedev"]}