CVE-2026-10285
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the KanbanScrumHelper::recordUpdated function in app/Helpers/KanbanScrumHelper.php. The attack can be performed remotely. The project has not responded.
Risk Assessment
An attacker can remotely perform unauthorized operations on tickets, potentially leading to data integrity issues.
Recommendation
Immediately update the software to a patched version or apply temporary mitigations, such as restricting access to the function.
Other vulnerabilities in DevaslanPHP project-management
See all- CVE-2026-100900Medium
In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the updateJiraProjects function in the /jira-import file of the Jira Import component leads to server-side request forgery via manipulation of host/username/token arguments. The attack can be initiated remotely. The exploit has been disclosed to the public.
- CVE-2026-100899Medium
In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack may be performed remotely. The exploit has been published.
- CVE-2026-100898Medium
In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack can be carried out remotely. The exploit is now public.
- CVE-2026-10284Medium
In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the editComment/doDeleteComment functions in app/Filament/Resources/TicketResource/Pages/ViewTicket.php. The attack can be performed remotely. The project has not responded.
Original NVD description (English source)
A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS