CVE-2026-59097

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59097", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-02T15:38:18.929Z", "datePublished": "2026-07-02T19:42:04.588Z", "dateUpdated": "2026-11-08T14:07:18.885Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:07:18.885Z"}, "datePublic": "2026-06-30T00:00:00.000Z", "title": "Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets", "descriptions": [{"lang": "en", "value": "Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves."}], "tags": ["x_open-source"], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "Missing Authorization", "type": "CWE"}]}], "affected": [{"vendor": "taiga", "product": "taiga-back", "defaultStatus": "unaffected", "packageURL": "pkg:github/taigaio/taiga-back", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "6.10.2"}], "repo": "https://github.com/taigaio/taiga-back"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:taiga:taiga:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.10.2"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "references": [{"url": "https://github.com/taigaio/taiga-back/releases/tag/6.10.2", "name": "taiga-back 6.10.2 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/taigaio/taiga-back/issues/244", "name": "Researcher Disclosure", "tags": ["technical-description", "exploit", "issue-tracking"]}, {"url": "https://github.com/taigaio/taiga-back/pull/245", "name": "Fix PR", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9", "name": "Fix Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/taigaio/taiga-back/issues/244", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T14:50:31.230166Z", "id": "CVE-2026-59097", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T14:50:35.051Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59097", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T14:50:31.230166Z"}}}], "references": [{"url": "https://github.com/taigaio/taiga-back/issues/244", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T14:50:16.029Z"}}], "cna": {"tags": ["x_open-source"], "title": "Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/taigaio/taiga-back", "vendor": "taiga", "product": "taiga-back", "versions": [{"status": "affected", "version": "0", "lessThan": "6.10.2", "versionType": "semver"}], "packageURL": "pkg:github/taigaio/taiga-back", "defaultStatus": "unaffected"}], "datePublic": "2026-06-30T00:00:00.000Z", "references": [{"url": "https://github.com/taigaio/taiga-back/releases/tag/6.10.2", "name": "taiga-back 6.10.2 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/taigaio/taiga-back/issues/244", "name": "Researcher Disclosure", "tags": ["technical-description", "exploit", "issue-tracking"]}, {"url": "https://github.com/taigaio/taiga-back/pull/245", "name": "Fix PR", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9", "name": "Fix Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:taiga:taiga:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:07:18.885Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59097", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:07:18.885Z", "dateReserved": "2026-07-02T15:38:18.929Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-02T19:42:04.588Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/taigaio/taiga-back", "product": "taiga-back", "repo": "https://github.com/taigaio/taiga-back", "vendor": "taiga", "versions": [{"lessThan": "6.10.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves."}, {"lang": "es", "value": "Taiga anterior a la versi\u00f3n 6.10.2 contiene una vulnerabilidad de autorizaci\u00f3n faltante que permite a atacantes remotos no autenticados crear registros de fechas de vencimiento predeterminadas en cualquier proyecto explotando puntos finales POST desprotegidos en los viewsets de la API de fechas de vencimiento de historias de usuario, tareas e incidencias. Los atacantes pueden suministrar un identificador de proyecto arbitrario a estos puntos finales, lo que omite las comprobaciones de permisos y aplica el valor predeterminado AllowAny, para adelantarse a los administradores de proyectos en la inicializaci\u00f3n de fechas de vencimiento creando registros antes de que ellos mismos puedan hacerlo."}], "id": "CVE-2026-59097", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59097", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T14:50:31.230166Z", "version": "2.0.3"}}]}, "published": "2026-07-02T20:17:07.990", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/taigaio/taiga-back/issues/244"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/taigaio/taiga-back/pull/245"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/taigaio/taiga-back/releases/tag/6.10.2"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/taigaio/taiga-back/issues/244"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.10.2)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 81.0, "source": "matching"}]}, "original": {"product": "taiga-back", "source": "cna", "vendor": "taiga"}, "product": "taiga", "vendor": "taiga"}], "created": "2026-07-03T03:15:03.830659+00:00", "updated": "2026-08-01T21:15:04.730364+00:00", "vendors": ["taiga", "taiga$PRODUCT$taiga"]}