CVE-2026-65055
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Vulnerability in Taiga 6.10.1 due to missing authorization in filters_data API endpoints. An unauthenticated attacker can disclose the full member roster and workflow configuration of private projects by supplying a project ID.
Risk Assessment
Risk of exposing sensitive project member information and internal processes, potentially compromising project privacy and security.
Recommendation
Update Taiga to the latest version and implement authorization mechanisms for filters_data endpoints.
Other vulnerabilities in Taiga
See all- CVE-2026-59097Medium
Taiga before version 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project. The attack exploits unprotected POST endpoints on the user-story, task, and issue due-date API viewsets.
- CVE-2025-62367Medium
Taiga, an open source project management platform, in versions 6.8.3 and earlier is vulnerable to time-based blind SQL injection, allowing sensitive data disclosure via response timing. This issue is fixed in version 6.9.0.
Original NVD description (English source)
Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS