CVE-2026-11440

MediumCVSS 6.3

Published: 06/06/2026(UTC)Updated: 08/06/2026(UTC)Translated: 09/06/2026(UTC)NVD NIST

Summary

A vulnerability was determined in theonedev up to version 15.0.5, affecting an unknown part of the file /repositories/{projectId}/default-branch of the REST API component. Manipulation of the argument project.defaultBranch causes improper authorization.

Risk Assessment

The organization may be exposed to remote attacks that could lead to unauthorized access to resources.

Recommendation

Upgrading to version 15.0.6 is advised to mitigate this vulnerability.

Original NVD description (English source)

A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the component REST API. This manipulation of the argument project.defaultBranch causes improper authorization. It is possible to initiate the attack remotely. Upgrading to version 15.0.6 is able to mitigate this issue. Upgrading the affected component is advised.