CVE-2026-11441
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An improper authorization vulnerability was detected in theonedev onedev up to version 15.0.5 in the canAccessIssue function of the /issues/ file in the Pull Request Handler component via manipulation of the issue argument. The attack can be carried out remotely. The issue is fixed in version 15.0.6.
Risk Assessment
A remote attacker can gain unauthorized access to issues, potentially leading to leakage of confidential information or manipulation of project data.
Recommendation
It is recommended to immediately update to version 15.0.6 or later.
Other vulnerabilities in onedev
See all- CVE-2026-44647High
OneDev is a Git server with CI/CD, kanban, and packages. Prior to version 15.0.2, there was behavior that broke the expected boundary between repository-controlled LFS metadata and server-local filesystem paths.
- CVE-2026-49248High
In versions 15.0.6 and below, the TarUtils.untar() function in OneDev creates symbolic links without validating whether the target is an absolute path. This allows writing to arbitrary server-side locations by authenticated users with CI Job write access.
- CVE-2026-11440Medium
An improper authorization vulnerability was detected in theonedev onedev up to version 15.0.5 in an unknown part of the file /repositories/{projectId}/default-branch in the REST API component via manipulation of the project.defaultBranch argument. The attack can be carried out remotely. The issue is fixed in version 15.0.6.
- CVE-2026-11439Medium
An improper authorization vulnerability was detected in theonedev onedev up to version 15.0.5 in an unknown functionality of the file /projects/ in the Parent Project Handler component via manipulation of the project.parentId argument. The attack can be carried out remotely. The issue is fixed in version 15.0.6.
- CVE-2026-11438Medium
An improper authorization vulnerability was detected in theonedev onedev up to version 15.0.5 in an unknown functionality of the file /projects via manipulation of the project.forkedFromId argument. The attack can be carried out remotely. The issue is fixed in version 15.0.6.
Original NVD description (English source)
A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely. Upgrading to version 15.0.6 is able to resolve this issue. It is advisable to upgrade the affected component.