CVE-2026-59097
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Taiga before version 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project. The attack exploits unprotected POST endpoints on the user-story, task, and issue due-date API viewsets.
Risk Assessment
The risk is that an attacker can disrupt due-date management in projects, preventing administrators from initializing default dates. This can lead to organizational chaos and loss of control over task schedules.
Recommendation
Immediately update Taiga to version 6.10.2 or later, which includes a fix for this vulnerability. Additionally, review permission settings for due-date related API endpoints.
Other vulnerabilities in Taiga
See all- CVE-2026-65055Medium
Vulnerability in Taiga 6.10.1 due to missing authorization in filters_data API endpoints. An unauthenticated attacker can disclose the full member roster and workflow configuration of private projects by supplying a project ID.
- CVE-2025-62367Medium
Taiga, an open source project management platform, in versions 6.8.3 and earlier is vulnerable to time-based blind SQL injection, allowing sensitive data disclosure via response timing. This issue is fixed in version 6.9.0.
Original NVD description (English source)
Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS