CVE-2025-11276

REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.

An SSRF vulnerability in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload, and URL parameters.

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.

A security flaw has been discovered in REBUILD up to 4.4.11 in unknown code of the /commons/file-editor-save file. Manipulation of the url/fileKey argument results in missing authorization. The attack can be launched remotely and the exploit has been released.

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5 in an unknown part of the /user/login file of the Login Endpoint component. The manipulation leads to improper authentication. The attack can be initiated remotely and the exploit is publicly available.

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages, which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.